drm/vc4: hvs/v3d: Fix null dereference in unbind
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 6.6.160, 6.12.111, 6.18.53, 7.1.6
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
In the Linux kernel, the following vulnerability has been resolved: drm/vc4: hvs/v3d: Fix null dereference in unbind The hvs and v3d drivers use dev_get_drvdata(master) in their unbind functions. Since the vc4-drm gets removed before its dependent drivers (vc4_hvs/vc4_v3d) the vc4_hvs_unbind/vc4_v3d_unbind functions try to get drvdata of its master and fails with a null dereference error. Use the data pointer passed to the unbind functions directly instead of dev_get_drvdata(master). This avoids using potentially freed memory.
Timeline
- CVE published
- Record last updated
Affected versions
- Linux Linux
From c8b75bca92cbf064b9fa125fc74a85994452e935 · fixed in 3be8dcc1a5854cf24cc332e0d6fc865c47ff49a1; From c8b75bca92cbf064b9fa125fc74a85994452e935 · fixed in 8f62aae059e06746a18a00af27179c3c0f17f4c7; From c8b75bca92cbf064b9fa125fc74a85994452e935 · fixed in 708688ec31ac6b35103ba364dc300a09930079d4; From c8b75bca92cbf064b9fa125fc74a85994452e935 · fixed in 261f0a3f0ac03248284f5116d3258f89c9642215; From c8b75bca92cbf064b9fa125fc74a85994452e935 · fixed in 7dc3680b7ffe01add3e9299fde8471d2dd53a8ae
- Linux Linux
4.4
- KernelLinux
From 4.4.0 · fixed in 6.6.160; From 6.7.0 · fixed in 6.12.111; From 6.13.0 · fixed in 6.18.53; From 6.19.0 · fixed in 7.1.6