Description
In the Linux kernel, the following vulnerability has been resolved: nfc: llcp: read llcp_sock->local under the socket lock in getsockopt nfc_llcp_getsockopt() read llcp_sock->local before lock_sock(sk) and then dereferenced the cached pointer inside the locked region. llcp_sock_bind() assigns and clears llcp_sock->local under the same socket lock, dropping the last reference on its error path. A getsockopt() racing an in-flight bind() can observe the pointer, block on lock_sock(), and then dereference a freed nfc_llcp_local once bind() has unwound. Move the llcp_sock->local read and the NULL check inside the lock_sock(sk) region so bind() cannot mutate or free the pointer between the load and the use.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
26fd76cab2e61cedc5c25f7151fb31b57ddc53c7 to < 56fd158fef20268f48db6cdfe5d722e930134edaaffected26fd76cab2e61cedc5c25f7151fb31b57ddc53c7 to < 8ba8cec0586727cc135ca4827921fc7b52946d71affected26fd76cab2e61cedc5c25f7151fb31b57ddc53c7 to < ed5240bab3468988077fe8bf29b935eaecc9ff89affected26fd76cab2e61cedc5c25f7151fb31b57ddc53c7 to < fe65727a4a21b11c18eebae1338482767a897b76affected26fd76cab2e61cedc5c25f7151fb31b57ddc53c7 to < 2d8ac24565be85bf56580b87bf1b874d35625eb5affected26fd76cab2e61cedc5c25f7151fb31b57ddc53c7 to < 156e65bd29307f5053835bff60bc1ba342fa010faffected26fd76cab2e61cedc5c25f7151fb31b57ddc53c7 to < d1b73962675cdc5a58e2707e25b548d8b495fde0affected26fd76cab2e61cedc5c25f7151fb31b57ddc53c7 to < 36812527052c5bfb1ec6c1e292d67a5bf76b750faffected
Linux Linux
Default version status: affected
3.10affected0 to < 3.10unaffected5.10.270 to ≤ 5.10.*unaffected5.15.221 to ≤ 5.15.*unaffected6.1.188 to ≤ 6.1.*unaffected6.6.157 to ≤ 6.6.*unaffected6.12.110 to ≤ 6.12.*unaffected6.18.52 to ≤ 6.18.*unaffected7.2.6 to ≤ 7.2.*unaffected7.3 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/56fd158fef20268f48db6cdfe5d722e930134eda ↗
- https://git.kernel.org/stable/c/8ba8cec0586727cc135ca4827921fc7b52946d71 ↗
- https://git.kernel.org/stable/c/ed5240bab3468988077fe8bf29b935eaecc9ff89 ↗
- https://git.kernel.org/stable/c/fe65727a4a21b11c18eebae1338482767a897b76 ↗
- https://git.kernel.org/stable/c/2d8ac24565be85bf56580b87bf1b874d35625eb5 ↗
- https://git.kernel.org/stable/c/156e65bd29307f5053835bff60bc1ba342fa010f ↗
- https://git.kernel.org/stable/c/d1b73962675cdc5a58e2707e25b548d8b495fde0 ↗
- https://git.kernel.org/stable/c/36812527052c5bfb1ec6c1e292d67a5bf76b750f ↗