Description
In the Linux kernel, the following vulnerability has been resolved: Input: ims-pcu - fix use-after-free and double-free in disconnect ims_pcu_disconnect() only intended to perform cleanup when the primary (control) interface is unbound. However, it currently relies on the interface class to distinguish between control and data interfaces. A malicious device could present a data interface with the same class as the control interface, leading to premature cleanup and potential use-after-free or double-free. Switch to verifying that the interface being disconnected is indeed the control interface.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
628329d52474323938a03826941e166bc7c8eff4 to < 315f269ea04bc1477ab9bf351e939623d12a1621affected628329d52474323938a03826941e166bc7c8eff4 to < 293388e42e5c0865204de6f36bfb8662156fce3baffected628329d52474323938a03826941e166bc7c8eff4 to < 921abbb33887052e46b1b77299f87a3c741dc580affected628329d52474323938a03826941e166bc7c8eff4 to < 6a6c373e6a82eddc522342c8a8db7072c65f2b56affected628329d52474323938a03826941e166bc7c8eff4 to < a4b3f4d42fbf58f06f0d49e37a9d0d9392eca338affected628329d52474323938a03826941e166bc7c8eff4 to < 6aacc18004b1a915ccb8a829d30279a37988066eaffected628329d52474323938a03826941e166bc7c8eff4 to < bf0b58ba489d0bdaa18c7dd8beeaeb954dd7dbb7affected628329d52474323938a03826941e166bc7c8eff4 to < 462a999917755a3bf77448dfd64307963cf0a9f0affected
Linux Linux
Default version status: affected
3.10affected0 to < 3.10unaffected5.10.261 to ≤ 5.10.*unaffected5.15.212 to ≤ 5.15.*unaffected6.1.178 to ≤ 6.1.*unaffected6.6.145 to ≤ 6.6.*unaffected6.12.97 to ≤ 6.12.*unaffected6.18.40 to ≤ 6.18.*unaffected7.1.5 to ≤ 7.1.*unaffected7.2 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/315f269ea04bc1477ab9bf351e939623d12a1621 ↗
- https://git.kernel.org/stable/c/293388e42e5c0865204de6f36bfb8662156fce3b ↗
- https://git.kernel.org/stable/c/921abbb33887052e46b1b77299f87a3c741dc580 ↗
- https://git.kernel.org/stable/c/6a6c373e6a82eddc522342c8a8db7072c65f2b56 ↗
- https://git.kernel.org/stable/c/a4b3f4d42fbf58f06f0d49e37a9d0d9392eca338 ↗
- https://git.kernel.org/stable/c/6aacc18004b1a915ccb8a829d30279a37988066e ↗
- https://git.kernel.org/stable/c/bf0b58ba489d0bdaa18c7dd8beeaeb954dd7dbb7 ↗
- https://git.kernel.org/stable/c/462a999917755a3bf77448dfd64307963cf0a9f0 ↗