Description
In the Linux kernel, the following vulnerability has been resolved: USB: gadget: fix NULL pointer dereference in gadget_dev_ioctl() gadget_dev_ioctl() reads dev->gadget before acquiring dev->lock, but dev->state is checked after acquiring the lock. Therefore a concurrent bind can change the device state between these operations, which can leave ioctl with a stale NULL gadget pointer and causing a NULL pointer dereference at gadget->ops->ioctl. Read dev->gadget while holding dev->lock so that the gadget pointer and device state are sampled consistently.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to < 8be30959be31b4205e3bdd2e2a6221f3a2ee7ea1affected1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to < e8219accce2f6d3502ed71f5b5e854ecf27249a6affected1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to < 87cbf9410b12f5c2d659bb01e8ecf6517cb9f28caffected1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to < 162178ca83c3de986900385a0477eb539f8e1a7eaffected1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to < ebd916fdfefaacbc0e577f7037ec96b31a105e5faffected1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to < c29a83c1ff3f06d5751f6d365b606c9f81ccc4cbaffected1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to < 64ec019bf9a8b12f53b9f2777d65aadb730b5a84affected1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to < dd0eed9e165b1a6292f49e622e3dd0b7d99b106daffected
Linux Linux
Default version status: affected
2.6.12affected0 to < 2.6.12unaffected5.10.270 to ≤ 5.10.*unaffected5.15.221 to ≤ 5.15.*unaffected6.1.188 to ≤ 6.1.*unaffected6.6.157 to ≤ 6.6.*unaffected6.12.110 to ≤ 6.12.*unaffected6.18.51 to ≤ 6.18.*unaffected7.2.5 to ≤ 7.2.*unaffected7.3 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/8be30959be31b4205e3bdd2e2a6221f3a2ee7ea1 ↗
- https://git.kernel.org/stable/c/e8219accce2f6d3502ed71f5b5e854ecf27249a6 ↗
- https://git.kernel.org/stable/c/87cbf9410b12f5c2d659bb01e8ecf6517cb9f28c ↗
- https://git.kernel.org/stable/c/162178ca83c3de986900385a0477eb539f8e1a7e ↗
- https://git.kernel.org/stable/c/ebd916fdfefaacbc0e577f7037ec96b31a105e5f ↗
- https://git.kernel.org/stable/c/c29a83c1ff3f06d5751f6d365b606c9f81ccc4cb ↗
- https://git.kernel.org/stable/c/64ec019bf9a8b12f53b9f2777d65aadb730b5a84 ↗
- https://git.kernel.org/stable/c/dd0eed9e165b1a6292f49e622e3dd0b7d99b106d ↗