In the Linux kernel, the following vulnerability has been resolved:
media: edia: dvbdev: fix a use-after-free
In dvb_register_device, *pdvbdev is set equal to dvbdev, which is freed
in several error-handling paths. However, *pdvbdev is not set to NULL
after dvbdev’s deallocation, causing use-after-frees in many places,
for example, in the following call chain:
budget_register
|-> dvb_dmxdev_init
|-> dvb_register_device
|-> dvb_dmxdev_release
|-> dvb_unregister_device
|-> dvb_remove_device
|-> dvb_device_put
|-> kref_put
When calling dvb_unregister_device, dmxdev->dvbdev (i.e. *pdvbdev in
dvb_register_device) could point to memory that had been freed in
dvb_register_device. Thereafter, this pointer is transferred to
kref_put and triggering a use-after-free.
Vendor | Product | Version | CPE |
---|---|---|---|
linux | linux_kernel | * | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
[
{
"product": "Linux",
"vendor": "Linux",
"defaultStatus": "unaffected",
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"programFiles": [
"drivers/media/dvb-core/dvbdev.c"
],
"versions": [
{
"version": "b61901024776",
"lessThan": "d0f5c2833382",
"status": "affected",
"versionType": "git"
},
{
"version": "b61901024776",
"lessThan": "f20c3270f3ed",
"status": "affected",
"versionType": "git"
},
{
"version": "b61901024776",
"lessThan": "096237039d00",
"status": "affected",
"versionType": "git"
},
{
"version": "b61901024776",
"lessThan": "0d3fe80b6d17",
"status": "affected",
"versionType": "git"
},
{
"version": "b61901024776",
"lessThan": "437a111f79a2",
"status": "affected",
"versionType": "git"
},
{
"version": "b61901024776",
"lessThan": "779e8db7efb2",
"status": "affected",
"versionType": "git"
},
{
"version": "b61901024776",
"lessThan": "35674111a043",
"status": "affected",
"versionType": "git"
},
{
"version": "b61901024776",
"lessThan": "b7586e902128",
"status": "affected",
"versionType": "git"
},
{
"version": "b61901024776",
"lessThan": "8c64f4cdf4e6",
"status": "affected",
"versionType": "git"
}
]
},
{
"product": "Linux",
"vendor": "Linux",
"defaultStatus": "affected",
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"programFiles": [
"drivers/media/dvb-core/dvbdev.c"
],
"versions": [
{
"version": "2.6.21",
"status": "affected"
},
{
"version": "0",
"lessThan": "2.6.21",
"status": "unaffected",
"versionType": "custom"
},
{
"version": "4.19.311",
"lessThanOrEqual": "4.19.*",
"status": "unaffected",
"versionType": "custom"
},
{
"version": "5.4.273",
"lessThanOrEqual": "5.4.*",
"status": "unaffected",
"versionType": "custom"
},
{
"version": "5.10.214",
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"versionType": "custom"
},
{
"version": "5.15.153",
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"versionType": "custom"
},
{
"version": "6.1.83",
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"versionType": "custom"
},
{
"version": "6.6.23",
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"versionType": "custom"
},
{
"version": "6.7.11",
"lessThanOrEqual": "6.7.*",
"status": "unaffected",
"versionType": "custom"
},
{
"version": "6.8.2",
"lessThanOrEqual": "6.8.*",
"status": "unaffected",
"versionType": "custom"
},
{
"version": "6.9",
"lessThanOrEqual": "*",
"status": "unaffected",
"versionType": "original_commit_for_fix"
}
]
}
]
git.kernel.org/stable/c/096237039d00c839f3e3a5fe6d001bf0db45b644
git.kernel.org/stable/c/0d3fe80b6d175c220b3e252efc6c6777e700e98e
git.kernel.org/stable/c/35674111a043b0482a9bc69da8850a83f465b07d
git.kernel.org/stable/c/437a111f79a2f5b2a5f21e27fdec6f40c8768712
git.kernel.org/stable/c/779e8db7efb22316c8581d6c229636d2f5694a62
git.kernel.org/stable/c/8c64f4cdf4e6cc5682c52523713af8c39c94e6d5
git.kernel.org/stable/c/b7586e902128e4fb7bfbb661cb52e4215a65637b
git.kernel.org/stable/c/d0f5c28333822f9baa5280d813124920720fd856
git.kernel.org/stable/c/f20c3270f3ed5aa6919a87e4de9bf6c05fb57086
lists.debian.org/debian-lts-announce/2024/06/msg00017.html
lists.debian.org/debian-lts-announce/2024/06/msg00020.html