Description
In the Linux kernel, the following vulnerability has been resolved: vduse: hold vduse_lock across IDR lookup in open path vduse_dev_open() looks up struct vduse_dev through the IDR and then acquires dev->lock only after vduse_lock has been dropped. This leaves a window where a concurrent VDUSE_DESTROY_DEV can remove the same object from the IDR and free it before the open path locks the device, leading to a use-after-free. Close this race by keeping vduse_lock held until dev->lock has been acquired in the open path, matching the lock ordering already used by the destroy path.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
c8a6153b6c59d95c0e091f053f6f180952ade91e to < 35483c5306e09b3190ff937089d404a78012695caffectedc8a6153b6c59d95c0e091f053f6f180952ade91e to < 5c1560be8aa6849356455af67518d35c551cbd95affectedc8a6153b6c59d95c0e091f053f6f180952ade91e to < 93ed4692f2299a40346025979f40e4a9b7b33af7affectedc8a6153b6c59d95c0e091f053f6f180952ade91e to < d94e2947203aead590fd63f667d316d4475d65afaffectedc8a6153b6c59d95c0e091f053f6f180952ade91e to < a2d0a57538fd0b3b3ab75d64bb64f4cd2fab13a2affectedc8a6153b6c59d95c0e091f053f6f180952ade91e to < 79e12c891940b0c4c75881b7fd82a8cbb8ac97beaffectedc8a6153b6c59d95c0e091f053f6f180952ade91e to < e440e077748939839d9f76e24383b76b785f80ceaffected
Linux Linux
Default version status: affected
5.15affected0 to < 5.15unaffected5.15.212 to ≤ 5.15.*unaffected6.1.178 to ≤ 6.1.*unaffected6.6.145 to ≤ 6.6.*unaffected6.12.97 to ≤ 6.12.*unaffected6.18.40 to ≤ 6.18.*unaffected7.1.5 to ≤ 7.1.*unaffected7.2 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/35483c5306e09b3190ff937089d404a78012695c ↗
- https://git.kernel.org/stable/c/5c1560be8aa6849356455af67518d35c551cbd95 ↗
- https://git.kernel.org/stable/c/93ed4692f2299a40346025979f40e4a9b7b33af7 ↗
- https://git.kernel.org/stable/c/d94e2947203aead590fd63f667d316d4475d65af ↗
- https://git.kernel.org/stable/c/a2d0a57538fd0b3b3ab75d64bb64f4cd2fab13a2 ↗
- https://git.kernel.org/stable/c/79e12c891940b0c4c75881b7fd82a8cbb8ac97be ↗
- https://git.kernel.org/stable/c/e440e077748939839d9f76e24383b76b785f80ce ↗