High · published May 24, 2024
In the Linux kernel, the following vulnerability has been resolved:
iio: mma8452: Fix trigger reference couting
The mma8452 driver directly assigns a trigger to the struct iio_dev. The
IIO core when done using this trigger will call `iio_trigger_put()` to drop
the reference count by 1.
Without the matching `iio_trigger_get()` in the driver the reference count
can reach 0 too early, the trigger gets freed while still in use and a
use-after-free occurs.
Fix this by getting a reference to the trigger before assigning it to the
IIO device.
| Product | Versions | Fixed in |
|---|---|---|
| linux/linux_kernel | ≥ 4.2, < 4.4.295 | 4.4.295 |
| linux/linux_kernel | ≥ 4.5, < 4.9.293 | 4.9.293 |
| linux/linux_kernel | ≥ 4.10, < 4.14.258 | 4.14.258 |
| linux/linux_kernel | ≥ 4.15, < 4.19.221 | 4.19.221 |
| linux/linux_kernel | ≥ 4.20, < 5.4.165 | 5.4.165 |
| linux/linux_kernel | ≥ 5.5, < 5.10.85 | 5.10.85 |
| linux/linux_kernel | ≥ 5.11, < 5.15.8 | 5.15.8 |
| linux/linux_kernel | all versions | — |
| linux/linux_kernel | all versions | — |
| linux/linux_kernel | all versions | — |
| linux/linux_kernel | all versions | — |