dmaengine: fsl-edma: tracing: no ptr dereference during log output
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 6.12.110, 6.18.51, 7.2.5
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
In the Linux kernel, the following vulnerability has been resolved: dmaengine: fsl-edma: tracing: no ptr dereference during log output The fsl edma events store a pointer to a struct fsl_edma_engine in the ringbuffer and dereference it when a log entry is printed. At this time, the pointer may no longer be valid. Event injection can be used to trigger a crash: $ cd /sys/kernel/tracing $ echo 'value = 0' > events/fsl_edma/edma_writeb/inject $ cat trace The log output needs only edma->membase. Add a membase field at the end of the event and use the new field for log output. Keep the existing fields for backward compatibility.
Timeline
- CVE published
- Record last updated
Affected versions
- Linux Linux
From 11102d0c343ba06ddd303f2503c0ce46d70052f2 · fixed in ef02cd3807f39ae1dbc924788d8fa6a85334c435; From 11102d0c343ba06ddd303f2503c0ce46d70052f2 · fixed in d382aaf5fed38c6dd2e0cc710d97cb81d660ffa7; From 11102d0c343ba06ddd303f2503c0ce46d70052f2 · fixed in 2a3801ae5c344473e648006c5b03a9216ac54a6a; From 11102d0c343ba06ddd303f2503c0ce46d70052f2 · fixed in 2ea04dca8e627f722caa7a2037cfbae0257f3501
- Linux Linux
6.10
- KernelLinux
From 6.10.0 · fixed in 6.12.110; From 6.13.0 · fixed in 6.18.51; From 6.19.0 · fixed in 7.2.5