Description
In the Linux kernel, the following vulnerability has been resolved: wifi: virt_wifi: don't transfer operstate before register virt_wifi_newlink() calls netif_stacked_transfer_operstate() before register_netdevice(). If the lower device is dormant, that queues the new netdev on lweventlist while it is still uninitialized. If registration fails after that, for example because of an invalid name such as "bad/name", free_netdev() immediately frees the object. A later linkwatch_fire_event() then use-after-frees the list entry. Move the transfer to after netdev_upper_dev_link(), as macvlan and ipvlan already do.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
c7cdba31ed8b87526db978976392802d3f93110c to < ee9ea1afd6990def51d52b3a0aecd5cfcc951da0affectedc7cdba31ed8b87526db978976392802d3f93110c to < 9ce26201f6dedf3fa02b97da8c67ee6f6c5f7225affectedc7cdba31ed8b87526db978976392802d3f93110c to < f9526054c2b2cace5916b7225603d008834ec011affectedc7cdba31ed8b87526db978976392802d3f93110c to < e8304e25c6dabb8accf38b807969438d0ce84fd7affectedc7cdba31ed8b87526db978976392802d3f93110c to < ca49763c42c1089d654bf11b037980a9ede3772caffectedc7cdba31ed8b87526db978976392802d3f93110c to < 293c56a66510bb7de073a1aba388e38abddff1fbaffectedc7cdba31ed8b87526db978976392802d3f93110c to < b808a9af5fd21f9c68b0d024eda7535b5dce6a4eaffectedc7cdba31ed8b87526db978976392802d3f93110c to < e5c8d7acd31b27057ea42cd405d0b3ece097bc89affected
Linux Linux
Default version status: affected
5.0affected0 to < 5.0unaffected5.10.271 to ≤ 5.10.*unaffected5.15.222 to ≤ 5.15.*unaffected6.1.189 to ≤ 6.1.*unaffected6.6.158 to ≤ 6.6.*unaffected6.12.112 to ≤ 6.12.*unaffected6.18.54 to ≤ 6.18.*unaffected7.2.8 to ≤ 7.2.*unaffected7.3 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/ee9ea1afd6990def51d52b3a0aecd5cfcc951da0 ↗
- https://git.kernel.org/stable/c/9ce26201f6dedf3fa02b97da8c67ee6f6c5f7225 ↗
- https://git.kernel.org/stable/c/f9526054c2b2cace5916b7225603d008834ec011 ↗
- https://git.kernel.org/stable/c/e8304e25c6dabb8accf38b807969438d0ce84fd7 ↗
- https://git.kernel.org/stable/c/ca49763c42c1089d654bf11b037980a9ede3772c ↗
- https://git.kernel.org/stable/c/293c56a66510bb7de073a1aba388e38abddff1fb ↗
- https://git.kernel.org/stable/c/b808a9af5fd21f9c68b0d024eda7535b5dce6a4e ↗
- https://git.kernel.org/stable/c/e5c8d7acd31b27057ea42cd405d0b3ece097bc89 ↗