Description (CNA)
In the Linux kernel, the following vulnerability has been resolved: dmaengine: fsl-edma: tracing: no ptr dereference during log output The fsl edma events store a pointer to a struct fsl_edma_engine in the ringbuffer and dereference it when a log entry is printed. At this time, the pointer may no longer be valid. Event injection can be used to trigger a crash: $ cd /sys/kernel/tracing $ echo 'value = 0' > events/fsl_edma/edma_writeb/inject $ cat trace The log output needs only edma->membase. Add a membase field at the end of the event and use the new field for log output. Keep the existing fields for backward compatibility.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Linux / Linux | affected 11102d0c343ba06ddd303f2503c0ce46d70052f2 before ef02cd3807f39ae1dbc924788d8fa6a85334c435; affected 11102d0c343ba06ddd303f2503c0ce46d70052f2 before d382aaf5fed38c6dd2e0cc710d97cb81d660ffa7; affected 11102d0c343ba06ddd303f2503c0ce46d70052f2 before 2a3801ae5c344473e648006c5b03a9216ac54a6a; affected 11102d0c343ba06ddd303f2503c0ce46d70052f2 before 2ea04dca8e627f722caa7a2037cfbae0257f3501 |
| Linux / Linux | affected 6.10; unaffected 0 before 6.10; unaffected 6.12.110 through 6.12.*; unaffected 6.18.51 through 6.18.*; unaffected 7.2.5 through 7.2.*; unaffected 7.3 through * |
CWE
No CWE identifiers supplied.