7.8

CVE-2022-50384

staging: vme_user: Fix possible UAF in tsi148_dma_list_add

In the Linux kernel, the following vulnerability has been resolved:

staging: vme_user: Fix possible UAF in tsi148_dma_list_add

Smatch report warning as follows:

drivers/staging/vme_user/vme_tsi148.c:1757 tsi148_dma_list_add() warn:
  '&entry->list' not removed from list

In tsi148_dma_list_add(), the error path "goto err_dma" will not
remove entry->list from list->entries, but entry will be freed,
then list traversal may cause UAF.

Fix by removeing it from list->entries before free().
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Linux ≫ Linux Kernel Version >= 4.2 < 4.9.337
Linux ≫ Linux Kernel Version >= 4.10 < 4.14.303
Linux ≫ Linux Kernel Version >= 4.15 < 4.19.270
Linux ≫ Linux Kernel Version >= 4.20 < 5.4.229
Linux ≫ Linux Kernel Version >= 5.5 < 5.10.163
Linux ≫ Linux Kernel Version >= 5.11 < 5.15.86
Linux ≫ Linux Kernel Version >= 5.16 < 6.0.16
Linux ≫ Linux Kernel Version >= 6.1 < 6.1.2
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.16% 0.051
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 7.8 1.8 5.9
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
134c704f-9b21-4f2e-91b3-4a467353bcc0 7.8 1.8 5.9
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE-416 Use After Free

The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

https://git.kernel.org/stable/c/5cc4eea715a3fcf4e516662f736dfee63979465f
Patch
https://git.kernel.org/stable/c/51c0ad3b7c5b01f9314758335a13f157b05fa56d
Patch
https://git.kernel.org/stable/c/e6b0adff99edf246ba1f8d464530a0438cb1cbda
Patch
https://git.kernel.org/stable/c/a45ba33d398a821147d7e5f16ead7eb125e331e2
Patch
https://git.kernel.org/stable/c/5d2b286eb034af114f67d9967fc3fbc1829bb712
Patch
https://git.kernel.org/stable/c/1f5661388f43df3ac106ce93e67d8d22b16a78ff
Patch
https://git.kernel.org/stable/c/cf138759a7e92c75cfc1b7ba705e4108fe330edf
Patch
https://git.kernel.org/stable/c/85db68fc901da52314ded80aace99f8b684c7815
Patch
https://git.kernel.org/stable/c/357057ee55d3c99a5de5abe8150f7bca04f8e53b
Patch