Description (CNA)
In the Linux kernel, the following vulnerability has been resolved: dibs: initialise dibs->lock in dibs_dev_alloc() dibs->lock is initialised by dibs_dev_add(), but a dibs device can already take interrupts before that call: ism_probe() runs ism_dev_init(), and hence request_irq(), before it calls dibs_dev_add(). No client can have registered a dmb at that point, so no dmb interrupt can occur, but a GID event interrupt can, and ism_handle_irq() takes dibs->lock unconditionally on entry, before it inspects anything else. Initialise the lock in dibs_dev_alloc() instead, so that it is valid as soon as a driver can publish the device to its interrupt handler.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Linux / Linux | affected cc21191b584c6f7836b0f10774f8278b7cbfba10 before fe79571f40434b257d68cbfb7b3ae93a794d8a11; affected cc21191b584c6f7836b0f10774f8278b7cbfba10 before 2926031acba100d0c18fcfaa7a2ed29609318848; affected cc21191b584c6f7836b0f10774f8278b7cbfba10 before c27e360545373b7aee9862a5beef3b9fb3df0c25 |
| Linux / Linux | affected 6.18; unaffected 0 before 6.18; unaffected 6.18.45 through 6.18.*; unaffected 7.1.9 through 7.1.*; unaffected 7.2 through * |
CWE
No CWE identifiers supplied.
References
- https://git.kernel.org/stable/c/fe79571f40434b257d68cbfb7b3ae93a794d8a11
- https://git.kernel.org/stable/c/2926031acba100d0c18fcfaa7a2ed29609318848
- https://git.kernel.org/stable/c/c27e360545373b7aee9862a5beef3b9fb3df0c25
ADP enrichment
No English description supplied.
No references supplied.