Description (CNA)
In the Linux kernel, the following vulnerability has been resolved: misc: fastrpc: fix use-after-free race in fastrpc_map_create fastrpc_map_lookup returns a raw pointer after releasing fl->lock. The caller fastrpc_map_create then calls fastrpc_map_get (kref_get_unless_zero) on this unprotected pointer. A concurrent MEM_UNMAP can free the map between the lock release and the kref operation, resulting in a use-after-free on the freed slab object. Restore the take_ref parameter to fastrpc_map_lookup so the reference is acquired atomically under fl->lock before the pointer is exposed to the caller.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Linux / Linux | affected 0b70ec82b309a4093106ff399da1911ad23b52d3 before 0a3b87293fbd34fda651e6aead9964f84b893962; affected d7513b47082c08105e837b06cebeb3f07a5fa56f before 8b080c89183196fd3e49212f2a1a1c4a29335b9c; affected 802359a52676176b18713e33caa17572ad009057 before 5b0166112019d1dce30b976ab28fd67f7f0be532; affected 10df039834f84a297c72ec962c0f9b7c8c5ca31a before 992f121796b7ca83a5a8b93da24e971363206218; affected 10df039834f84a297c72ec962c0f9b7c8c5ca31a before f20f6512ecb75c816e0debf4551a138f098615c4; affected 10df039834f84a297c72ec962c0f9b7c8c5ca31a before 07ebe87915d8accdaba20c4f88c5ae430fe62fbb; affected f3f59bab68e9bc714f757ab22f3fb36153014043; affected 6.1.156 before 6.1.176; affected 6.6.112 before 6.6.143; affected 6.12.53 before 6.12.94; affected 6.17.3 before 6.18 |
| Linux / Linux | affected 6.18; unaffected 0 before 6.18; unaffected 6.1.176 through 6.1.*; unaffected 6.6.143 through 6.6.*; unaffected 6.12.94 through 6.12.*; unaffected 6.18.36 through 6.18.*; unaffected 7.0.13 through 7.0.*; unaffected 7.1 through * |
CWE
No CWE identifiers supplied.
References
- https://git.kernel.org/stable/c/0a3b87293fbd34fda651e6aead9964f84b893962
- https://git.kernel.org/stable/c/8b080c89183196fd3e49212f2a1a1c4a29335b9c
- https://git.kernel.org/stable/c/5b0166112019d1dce30b976ab28fd67f7f0be532
- https://git.kernel.org/stable/c/992f121796b7ca83a5a8b93da24e971363206218
- https://git.kernel.org/stable/c/f20f6512ecb75c816e0debf4551a138f098615c4
- https://git.kernel.org/stable/c/07ebe87915d8accdaba20c4f88c5ae430fe62fbb