usb: gadget: f_hid: don't call cdev_init while cdev in use
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 6.6.160, 6.12.83, 6.18.24, 6.19.14, 7.0.1
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
In the Linux kernel, the following vulnerability has been resolved: usb: gadget: f_hid: don't call cdev_init while cdev in use When calling unbind, then bind again, cdev_init reinitialized the cdev, even though there may still be references to it. That's the case when the /dev/hidg* device is still opened. This obviously unsafe behavior like oopes. This fixes this by using cdev_alloc to put the cdev on the heap. That way, we can simply allocate a new one in hidg_bind.
Timeline
- CVE published
- Record last updated
Affected versions
- Linux Linux
From cb382536052fcc7713988869b54a81137069e5a9 · fixed in 3aa77f5da0ecb00895411f4246d8a3e4db0343c2; From cb382536052fcc7713988869b54a81137069e5a9 · fixed in c6c0d13db5d0f8d465eabc14bd23d2b6a7247a43; From cb382536052fcc7713988869b54a81137069e5a9 · fixed in eb6ef6185f2054a341ec70d7e2165f5381744215; From cb382536052fcc7713988869b54a81137069e5a9 · fixed in 5a229016ca3ac551294ec59770be9da94ec4bf63; From cb382536052fcc7713988869b54a81137069e5a9 · fixed in 75ecc46828ec377dd5692c677168ef6d64fd7123; From cb382536052fcc7713988869b54a81137069e5a9 · fixed in 81ebd43cc0d6d106ce7b6ccbf7b5e40ca7f5503d
- Linux Linux
3.19
- KernelLinux
From 3.19.0 · fixed in 6.6.160; From 6.7.0 · fixed in 6.12.83; From 6.13.0 · fixed in 6.18.24; From 6.19.0 · fixed in 6.19.14; From 6.20.0 · fixed in 7.0.1