iio: imu: adis16400: fix unprotected debugfs reads
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 6.6.160, 6.12.113, 6.18.56, 7.2.10
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
In the Linux kernel, the following vulnerability has been resolved: iio: imu: adis16400: fix unprotected debugfs reads adis16400_serial_number_fops is open coded and never calls debugfs_file_get(), so debugfs_remove_recursive() does not wait for a read in progress and unbind frees the iio_dev underneath it. Commit ae1d37a9bb4b ("iio: imu: adis16400: use DEFINE_DEBUGFS_ATTRIBUTE instead of DEFINE_SIMPLE_ATTRIBUTE") converted product_id and flash_count to DEFINE_DEBUGFS_ATTRIBUTE, which protects itself, but moved all three files to debugfs_create_file_unsafe(). serial_number prints three registers as "%.4x-%.4x-%.4x" and DEFINE_DEBUGFS_ATTRIBUTE() formats a single u64, so it cannot be converted without changing what the file returns. adis16475 and adis16550 already use debugfs_create_file() for their open coded files. Use it here too.
Timeline
- CVE published
- Record last updated
Affected versions
- Linux Linux
From ae1d37a9bb4bd8d9091a40d153143e99b115ee37 · fixed in d3078aaef8af4648f94eeafde4b7b36efd9838d1; From ae1d37a9bb4bd8d9091a40d153143e99b115ee37 · fixed in e9b4c00f775a915b759b08bfe2c5e806a8301a59; From ae1d37a9bb4bd8d9091a40d153143e99b115ee37 · fixed in 50e8d70ba0743f88afd7e49f9cebd1841ee677f5; From ae1d37a9bb4bd8d9091a40d153143e99b115ee37 · fixed in f501302ebb9e1504162351b951fe3ae331c852ab; From ae1d37a9bb4bd8d9091a40d153143e99b115ee37 · fixed in d94787287a113a1326211647d5e0deed1e9de105
- Linux Linux
5.8
- KernelLinux
From 5.8.0 · fixed in 6.6.160; From 6.7.0 · fixed in 6.12.113; From 6.13.0 · fixed in 6.18.56; From 6.19.0 · fixed in 7.2.10