net/dibs: Correct freeing of dmb_clientid_arr
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 6.18.45, 7.1.9
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
- Exploitation: none
- Automatable: no
- Technical impact: total
Summary
In the Linux kernel, the following vulnerability has been resolved: net/dibs: Correct freeing of dmb_clientid_arr A dibs device interrupt handler can be active after dibs_dev_del() and may still access dmb_clientid_arr. (UAF) In case of a failure in dibs_dev_add() being called by dibs_lo_dev_probe() dmb_clientid_arr is freed twice (double free). Free dmb_clientid_arr in dibs_dev_release() after last reference is gone. Note that allocating in dibs_dev_add() instead of dibs_dev_alloc() is ok for now, because no dmbs can be registered before dibs_dev_add().
Timeline
- CVE published
- CISA SSVC assessment
Exploitation: none · Automatable: no · Technical impact: total
- Record last updated
Affected versions
- Linux Linux
From cc21191b584c6f7836b0f10774f8278b7cbfba10 · fixed in ece6426b61241e9bfb41aa131f235168f55229b1; From cc21191b584c6f7836b0f10774f8278b7cbfba10 · fixed in 7a1df20a8d2cc89e3a442b6e0b43b1cacde8d403; From cc21191b584c6f7836b0f10774f8278b7cbfba10 · fixed in 9e6869be49064915edb6c8776b27c376cfdb0df5
- Linux Linux
6.18
- KernelLinux
From 6.18.0 · fixed in 6.18.45; From 6.19.0 · fixed in 7.1.9