media: staging/ipu7: fix async notifier UAF on probe error path
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 6.18.50, 7.2.4
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
In the Linux kernel, the following vulnerability has been resolved: media: staging/ipu7: fix async notifier UAF on probe error path isys_register_devices() registers the V4L2 async notifier via isys_notifier_init(). If a subsequent probe step such as isys_fw_log_init() fails, isys_probe() jumps to the out_cleanup label which only calls isys_unregister_devices(). That helper tears down the video devices, subdevices, V4L2 device and media device, but never unregisters or cleans up the async notifier. As a result the notifier stays chained in the global notifier_list while the enclosing struct ipu7_isys is freed by devres, leading to list corruption and a use-after-free the next time the list is walked. The remove path already does the right thing by calling isys_notifier_cleanup() before isys_unregister_devices(). Mirror that on the probe error path so the notifier is unregistered and cleaned up before the device is torn down.
Timeline
- CVE published
- Record last updated
Affected versions
- Linux Linux
From a516d36bdc3d8373f904af57c95e76d6f921cf1c · fixed in 2a8dd9fd12f3f6b21207cec8f50c92cd428e6b81; From a516d36bdc3d8373f904af57c95e76d6f921cf1c · fixed in 323c411fb63122e8cef5b833032d69d59a838559; From a516d36bdc3d8373f904af57c95e76d6f921cf1c · fixed in d7f48aa7d60c65d3e6d5312c27f17d5525a245fb
- Linux Linux
6.17
- KernelLinux
From 6.17.0 · fixed in 6.18.50; From 6.19.0 · fixed in 7.2.4