sh: push-switch: Reorder cleanup operations to avoid use-after-free bug
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 6.1.189, 6.5.4
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
- Exploitation: none
- Automatable: no
- Technical impact: total
Summary
In the Linux kernel, the following vulnerability has been resolved: sh: push-switch: Reorder cleanup operations to avoid use-after-free bug The original code puts flush_work() before timer_shutdown_sync() in switch_drv_remove(). Although we use flush_work() to stop the worker, it could be rescheduled in switch_timer(). As a result, a use-after-free bug can occur. The details are shown below: (cpu 0) | (cpu 1) switch_drv_remove() | flush_work() | ... | switch_timer // timer | schedule_work(&psw->work) timer_shutdown_sync() | ... | switch_work_handler // worker kfree(psw) // free | | psw->state = 0 // use This patch puts timer_shutdown_sync() before flush_work() to mitigate the bugs. As a result, the worker and timer will be stopped safely before the deallocate operations.
Timeline
- CVE published
- CISA SSVC assessment
Exploitation: none · Automatable: no · Technical impact: total
- Record last updated
Affected versions
- Linux Linux
From 9f5e8eee5cfe1328660c71812d87c2a67bda389f · fixed in ff635d1f143b55fa005e9e43b16e6d8f677e90a5; From 9f5e8eee5cfe1328660c71812d87c2a67bda389f · fixed in 610dbd8ac271aa36080aac50b928d700ee3fe4de; From 9f5e8eee5cfe1328660c71812d87c2a67bda389f · fixed in 246f80a0b17f8f582b2c0996db02998239057c65
- Linux Linux
2.6.20
- KernelLinux
From 2.6.20 · fixed in 6.1.189; From 6.2.0 · fixed in 6.5.4