Description (CNA)
In the Linux kernel, the following vulnerability has been resolved: watchdog: at91sam9_wdt: prevent timer rearm during teardown at91_ping() rearms the watchdog timer from its callback. timer_delete() neither waits for a running callback nor prevents it from rearming the timer, so probe failure or driver removal can leave the timer accessing the devm-allocated at91wdt after it has been freed. Use timer_shutdown_sync() on both teardown paths. It waits for a running callback and rejects any attempt by the callback to rearm the timer.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Linux / Linux | affected 5161b31dc39a6d6dadc95f298de48a725b73ada8 before a9e0efcb1125e6b452c648671f15920c4955b681; affected 5161b31dc39a6d6dadc95f298de48a725b73ada8 before 1beb4dd6a30dea699e98990dd61f892ed1c0985e; affected 5161b31dc39a6d6dadc95f298de48a725b73ada8 before 29fe74c9aa69d78c1c6a3930f1d9fc5db71a6eed; affected 5161b31dc39a6d6dadc95f298de48a725b73ada8 before b7949b0a7d998013b7ec8617a0ef5b07cca80be4; affected 5161b31dc39a6d6dadc95f298de48a725b73ada8 before 8444d66aa6b6e7fe0a26fa1a00a11cb4d0523783 |
| Linux / Linux | affected 3.14; unaffected 0 before 3.14; unaffected 6.6.160 through 6.6.*; unaffected 6.12.114 through 6.12.*; unaffected 6.18.45 through 6.18.*; unaffected 7.1.9 through 7.1.*; unaffected 7.2 through * |
CWE
No CWE identifiers supplied.
References
- https://git.kernel.org/stable/c/a9e0efcb1125e6b452c648671f15920c4955b681
- https://git.kernel.org/stable/c/1beb4dd6a30dea699e98990dd61f892ed1c0985e
- https://git.kernel.org/stable/c/29fe74c9aa69d78c1c6a3930f1d9fc5db71a6eed
- https://git.kernel.org/stable/c/b7949b0a7d998013b7ec8617a0ef5b07cca80be4
- https://git.kernel.org/stable/c/8444d66aa6b6e7fe0a26fa1a00a11cb4d0523783