platform/chrome: cros_ec_debugfs: Unregister panic notifier
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 6.6.157, 6.12.110, 6.18.52, 7.2.6
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
In the Linux kernel, the following vulnerability has been resolved: platform/chrome: cros_ec_debugfs: Unregister panic notifier cros_ec_debugfs_probe() registers notifier_panic with the EC panic notifier chain. The remove path tears down debugfs and the console log, but leaves the notifier registered. A later panic notification can call back into the removed instance and queue work that accesses released data. Unregister the panic notifier before tearing down the debugfs and console log state. This issue was found by a static analysis tool.
Timeline
- CVE published
- Record last updated
Affected versions
- Linux Linux
From d90fa2c64d59f5f151beeef5dbc599784b3391ca · fixed in 56989e2a9c292ff7689603feed41d030301ca636; From d90fa2c64d59f5f151beeef5dbc599784b3391ca · fixed in a5d3128b06ccfc398c2e456fddebadce52310bd8; From d90fa2c64d59f5f151beeef5dbc599784b3391ca · fixed in e2cbe14361d7cb0b5abd66d87f3afa0e16efde9f; From d90fa2c64d59f5f151beeef5dbc599784b3391ca · fixed in 05c1081ae4503e45b934b390350f942db3208892; From d90fa2c64d59f5f151beeef5dbc599784b3391ca · fixed in e5954d3031fb55dd31aa59bae477d63c68e941c0
- Linux Linux
6.3
- KernelLinux
From 6.3.0 · fixed in 6.6.157; From 6.7.0 · fixed in 6.12.110; From 6.13.0 · fixed in 6.18.52; From 6.19.0 · fixed in 7.2.6