Description
In the Linux kernel, the following vulnerability has been resolved: tty: vcc: hold port lock when clearing tty pointer in vcc_cleanup vcc_cleanup() sets port->tty to NULL without holding port->lock, racing with vcc_event() LDC callbacks that read port->tty under port->lock and then use tty->port. This can cause a use-after-free when the callback dereferences tty->port after cleanup has already destroyed and freed it.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
8f03f948ba356b7cb254b45a4e78b5b3d86fd3bb to < 57753441ef84bee3bf0e9ee1e3778d119c44aa32affected8f03f948ba356b7cb254b45a4e78b5b3d86fd3bb to < 88f6ecb058801e9ce7b9aabc966530118d7cd53caffected8f03f948ba356b7cb254b45a4e78b5b3d86fd3bb to < 821050631750e982007c0856c119346edba51caeaffected8f03f948ba356b7cb254b45a4e78b5b3d86fd3bb to < 1a9fb9eaeb69b1f6c00bed09289a33d9fe1e7ae4affected8f03f948ba356b7cb254b45a4e78b5b3d86fd3bb to < 03b49c991abb8d021ca6fe51cd173447236b0552affected
Linux Linux
Default version status: affected
4.14affected0 to < 4.14unaffected6.6.160 to ≤ 6.6.*unaffected6.12.113 to ≤ 6.12.*unaffected6.18.56 to ≤ 6.18.*unaffected7.2.10 to ≤ 7.2.*unaffected7.3 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/57753441ef84bee3bf0e9ee1e3778d119c44aa32 ↗
- https://git.kernel.org/stable/c/88f6ecb058801e9ce7b9aabc966530118d7cd53c ↗
- https://git.kernel.org/stable/c/821050631750e982007c0856c119346edba51cae ↗
- https://git.kernel.org/stable/c/1a9fb9eaeb69b1f6c00bed09289a33d9fe1e7ae4 ↗
- https://git.kernel.org/stable/c/03b49c991abb8d021ca6fe51cd173447236b0552 ↗