Description
In the Linux kernel, the following vulnerability has been resolved: ubi: Fix rollback for explicit UBI device numbers ubi_init_attach() rolls back module initialization failures by scanning ubi_devices[0..i-1], where i is the mtd= parameter index. That assumes the parameter index matches the UBI device number. That assumption is not true when mtd= specifies an explicit ubi_num. A successfully attached device can be stored at a higher ubi_devices[] slot, and a later failure can miss it during rollback. Scan the full ubi_devices[] array and detach by the actual array index, matching the way UBI devices are stored.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
83ff59a066637a6c28844bbf43009459408240f4 to < 83c978921688af40dcab6db74882d1ff9b0b765caffected83ff59a066637a6c28844bbf43009459408240f4 to < 6b92e66ec6dd8019e8efb2a568ef7c967c5a18c5affected83ff59a066637a6c28844bbf43009459408240f4 to < 4417ab6ecad01cf2d01045ef8104c95a66b0e893affected83ff59a066637a6c28844bbf43009459408240f4 to < 552e565ed8846e7db143e4a6bdf3f5677453c686affected83ff59a066637a6c28844bbf43009459408240f4 to < 9754f049d5f1945d4c691d1f52824eb8daf8f9beaffected83ff59a066637a6c28844bbf43009459408240f4 to < e3f7e58189bc222971ddc860f1716f37e51ba996affected83ff59a066637a6c28844bbf43009459408240f4 to < 87b3da4acb860605643ebee312178f13b20744cfaffected83ff59a066637a6c28844bbf43009459408240f4 to < 5b0a6b554e12a97f9771a9a9f4ea1f5457373c73affected
Linux Linux
Default version status: affected
3.11affected0 to < 3.11unaffected5.10.270 to ≤ 5.10.*unaffected5.15.221 to ≤ 5.15.*unaffected6.1.188 to ≤ 6.1.*unaffected6.6.157 to ≤ 6.6.*unaffected6.12.110 to ≤ 6.12.*unaffected6.18.52 to ≤ 6.18.*unaffected7.2.6 to ≤ 7.2.*unaffected7.3 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/83c978921688af40dcab6db74882d1ff9b0b765c ↗
- https://git.kernel.org/stable/c/6b92e66ec6dd8019e8efb2a568ef7c967c5a18c5 ↗
- https://git.kernel.org/stable/c/4417ab6ecad01cf2d01045ef8104c95a66b0e893 ↗
- https://git.kernel.org/stable/c/552e565ed8846e7db143e4a6bdf3f5677453c686 ↗
- https://git.kernel.org/stable/c/9754f049d5f1945d4c691d1f52824eb8daf8f9be ↗
- https://git.kernel.org/stable/c/e3f7e58189bc222971ddc860f1716f37e51ba996 ↗
- https://git.kernel.org/stable/c/87b3da4acb860605643ebee312178f13b20744cf ↗
- https://git.kernel.org/stable/c/5b0a6b554e12a97f9771a9a9f4ea1f5457373c73 ↗