Description
In the Linux kernel, the following vulnerability has been resolved: wifi: brcmsmac: fix UAF in brcms_free_timer() brcms_free_timer() calls brcms_del_timer() which uses the non-synchronous cancel_delayed_work() to cancel the timer's underlying delayed work. If the work callback (_brcms_timer) is already running, cancel_delayed_work() returns false without waiting, and brcms_free_timer() proceeds to kfree(t) while the callback still accesses t through container_of(). Add an explicit cancel_delayed_work_sync() after brcms_del_timer() to guarantee that any in-flight callback has completed before the timer structure is freed.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
5b435de0d786869c95d1962121af0d7df2542009 to < 10eeb0b29fd7f52487c9ae573e8d79c210a0095daffected5b435de0d786869c95d1962121af0d7df2542009 to < 74acccc928851f69184271832d690607877122afaffected5b435de0d786869c95d1962121af0d7df2542009 to < 050d2486e8ed2c0a23b87249ccd23e8072721391affected5b435de0d786869c95d1962121af0d7df2542009 to < 856dabd5f2617efb23c043be9e1b22a9e6e97c41affected5b435de0d786869c95d1962121af0d7df2542009 to < 2a4841ff0b74b495cddd31ae324e922217fc2f13affected5b435de0d786869c95d1962121af0d7df2542009 to < 1edb3ddd261e973a4d577c0547e63bfa25a8170daffected5b435de0d786869c95d1962121af0d7df2542009 to < 777cb6bba59e875b16a1d8897a483a5fecfcd5d2affected5b435de0d786869c95d1962121af0d7df2542009 to < 1eeca1d5e0920fbdad6449768fd2d4364e714180affected
Linux Linux
Default version status: affected
3.2affected0 to < 3.2unaffected5.10.271 to ≤ 5.10.*unaffected5.15.222 to ≤ 5.15.*unaffected6.1.189 to ≤ 6.1.*unaffected6.6.158 to ≤ 6.6.*unaffected6.12.112 to ≤ 6.12.*unaffected6.18.54 to ≤ 6.18.*unaffected7.2.8 to ≤ 7.2.*unaffected7.3 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/10eeb0b29fd7f52487c9ae573e8d79c210a0095d ↗
- https://git.kernel.org/stable/c/74acccc928851f69184271832d690607877122af ↗
- https://git.kernel.org/stable/c/050d2486e8ed2c0a23b87249ccd23e8072721391 ↗
- https://git.kernel.org/stable/c/856dabd5f2617efb23c043be9e1b22a9e6e97c41 ↗
- https://git.kernel.org/stable/c/2a4841ff0b74b495cddd31ae324e922217fc2f13 ↗
- https://git.kernel.org/stable/c/1edb3ddd261e973a4d577c0547e63bfa25a8170d ↗
- https://git.kernel.org/stable/c/777cb6bba59e875b16a1d8897a483a5fecfcd5d2 ↗
- https://git.kernel.org/stable/c/1eeca1d5e0920fbdad6449768fd2d4364e714180 ↗