Description
In the Linux kernel, the following vulnerability has been resolved: cpufreq: pcc: fix use-after-free and double free in _OSC evaluation pcc_cpufreq_do_osc() calls acpi_evaluate_object() twice for the two-phase _OSC negotiation. Between the two calls it freed output.pointer but left output.length unchanged. Since acpi_evaluate_object() treats a non-zero length with a non-NULL pointer as an existing buffer to write into, the second call wrote into freed memory (use-after-free). The subsequent kfree(output.pointer) at out_free then freed the same pointer a second time (double free). Reset output.pointer to NULL and output.length to ACPI_ALLOCATE_BUFFER after freeing the first result, so ACPICA allocates a fresh buffer for each phase independently.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
0f1d683fb35d6c6f49ef696c95757f3970682a0e to < 8e454e9d0bc03446d610ee49abec9dfd424f6541affected0f1d683fb35d6c6f49ef696c95757f3970682a0e to < 632666a63116d8061c62a988d1ca39dcd6d27c9baffected0f1d683fb35d6c6f49ef696c95757f3970682a0e to < 5cdb25f144b101083d8bf3fd023ad87fbe6850d7affected0f1d683fb35d6c6f49ef696c95757f3970682a0e to < 982c9f92d57bda2b769851ff6d90d43dcf5f3734affected0f1d683fb35d6c6f49ef696c95757f3970682a0e to < a36ca93a8ba57464e521d70a337d37f069064111affected0f1d683fb35d6c6f49ef696c95757f3970682a0e to < 6ba6f6783be2ffeb2cbcdc9321c4b9f708f796f7affected0f1d683fb35d6c6f49ef696c95757f3970682a0e to < 0e3c739a2f6fc1de5b19a8839ab80696b9cb2a29affected0f1d683fb35d6c6f49ef696c95757f3970682a0e to < 266d3dd8b757b48a576e90f018b51f7b7563cc32affected
Linux Linux
Default version status: affected
2.6.34affected0 to < 2.6.34unaffected5.10.261 to ≤ 5.10.*unaffected5.15.212 to ≤ 5.15.*unaffected6.1.178 to ≤ 6.1.*unaffected6.6.145 to ≤ 6.6.*unaffected6.12.96 to ≤ 6.12.*unaffected6.18.39 to ≤ 6.18.*unaffected7.1.4 to ≤ 7.1.*unaffected7.2 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/8e454e9d0bc03446d610ee49abec9dfd424f6541 ↗
- https://git.kernel.org/stable/c/632666a63116d8061c62a988d1ca39dcd6d27c9b ↗
- https://git.kernel.org/stable/c/5cdb25f144b101083d8bf3fd023ad87fbe6850d7 ↗
- https://git.kernel.org/stable/c/982c9f92d57bda2b769851ff6d90d43dcf5f3734 ↗
- https://git.kernel.org/stable/c/a36ca93a8ba57464e521d70a337d37f069064111 ↗
- https://git.kernel.org/stable/c/6ba6f6783be2ffeb2cbcdc9321c4b9f708f796f7 ↗
- https://git.kernel.org/stable/c/0e3c739a2f6fc1de5b19a8839ab80696b9cb2a29 ↗
- https://git.kernel.org/stable/c/266d3dd8b757b48a576e90f018b51f7b7563cc32 ↗