Description
In the Linux kernel, the following vulnerability has been resolved: wifi: libertas_tf: fix UAF in lbtf_free_adapter() lbtf_free_adapter() calls lbtf_free_cmd_buffer() to free the command buffers before calling timer_delete_sync() to wait for the command timer callback. If the timer callback (command_timer_fn) is already running when lbtf_free_cmd_buffer() frees the command array, the callback dereferences priv->cur_cmd->cmdbuf which points to freed memory. Swap the order so that timer_delete_sync() runs first, ensuring any in-flight callback has completed before the command buffers are freed.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
06b16ae5319251c26377afcb401e46056d5673f4 to < 3fb3663260ec396f86b733aab9f81fac6669d2faaffected06b16ae5319251c26377afcb401e46056d5673f4 to < f6c3fa0d17ca0c9e6033bb45f52e33b27a9a40e6affected06b16ae5319251c26377afcb401e46056d5673f4 to < b4745d6063758c681d33affca9733bbd356b6ea1affected06b16ae5319251c26377afcb401e46056d5673f4 to < 41b1a4d545ec348b7d5324b6d4f4c6a3e0326d46affected06b16ae5319251c26377afcb401e46056d5673f4 to < 2b99bfc5a127ce8cd6a887d82815fc2e712f365baffected06b16ae5319251c26377afcb401e46056d5673f4 to < e82536aad653e27c8ca7a8e0f6f816bc3f853ec3affected06b16ae5319251c26377afcb401e46056d5673f4 to < 04c837d413dc11a91e0275b08b9e35a6c111175eaffected06b16ae5319251c26377afcb401e46056d5673f4 to < bbb9a0ab96d44a64529aafc7a16de460a1712f6aaffected
Linux Linux
Default version status: affected
2.6.28affected0 to < 2.6.28unaffected5.10.271 to ≤ 5.10.*unaffected5.15.222 to ≤ 5.15.*unaffected6.1.189 to ≤ 6.1.*unaffected6.6.158 to ≤ 6.6.*unaffected6.12.112 to ≤ 6.12.*unaffected6.18.54 to ≤ 6.18.*unaffected7.2.8 to ≤ 7.2.*unaffected7.3 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/3fb3663260ec396f86b733aab9f81fac6669d2fa ↗
- https://git.kernel.org/stable/c/f6c3fa0d17ca0c9e6033bb45f52e33b27a9a40e6 ↗
- https://git.kernel.org/stable/c/b4745d6063758c681d33affca9733bbd356b6ea1 ↗
- https://git.kernel.org/stable/c/41b1a4d545ec348b7d5324b6d4f4c6a3e0326d46 ↗
- https://git.kernel.org/stable/c/2b99bfc5a127ce8cd6a887d82815fc2e712f365b ↗
- https://git.kernel.org/stable/c/e82536aad653e27c8ca7a8e0f6f816bc3f853ec3 ↗
- https://git.kernel.org/stable/c/04c837d413dc11a91e0275b08b9e35a6c111175e ↗
- https://git.kernel.org/stable/c/bbb9a0ab96d44a64529aafc7a16de460a1712f6a ↗