mei: bus: access mei_device under device_lock on cleanup
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 6.1.184, 6.6.148, 6.12.101, 6.16, 6.17
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
In the Linux kernel, the following vulnerability has been resolved: mei: bus: access mei_device under device_lock on cleanup Fix couple of problems in mei_cl_bus_dev_release(): mei_cl_flush_queues() is running without lock. bus->file_list access after mei_dev_bus_put(bus) can become a use-after-free if this was the last reference to bus. Protect queues cleanup and WARN traversal by device lock there to avoid the concurrent access problems. Move WARN traversal before mei_dev_bus_put(bus). This file uses bus variable name for mei_device, adjust code of mei_cl_bus_dev_release() to use bus variable too.
Timeline
- CVE published
- Record last updated
Affected versions
- Linux Linux
From 6.1.149 · fixed in 6.1.184; From 6.6.103 · fixed in 6.6.148; From 6.12.43 · fixed in 6.12.101; From 6.15.11 · fixed in 6.16; From 6.16.2 · fixed in 6.17
- Linux Linux
6.17