High · published July 16, 2024
In the Linux kernel, the following vulnerability has been resolved:
iwlwifi: fix use-after-free
If no firmware was present at all (or, presumably, all of the
firmware files failed to parse), we end up unbinding by calling
device_release_driver(), which calls remove(), which then in
iwlwifi calls iwl_drv_stop(), freeing the 'drv' struct. However
the new code I added will still erroneously access it after it
was freed.
Set 'failure=false' in this case to avoid the access, all data
was already freed anyway.
| Product | Versions | Fixed in |
|---|---|---|
| linux/linux_kernel | ≥ 4.14.263, < 4.14.268 | 4.14.268 |
| linux/linux_kernel | ≥ 4.19.226, < 4.19.231 | 4.19.231 |
| linux/linux_kernel | ≥ 5.4.174, < 5.4.181 | 5.4.181 |
| linux/linux_kernel | ≥ 5.10.94, < 5.10.102 | 5.10.102 |
| linux/linux_kernel | ≥ 5.15.17, < 5.15.25 | 5.15.25 |
| linux/linux_kernel | ≥ 5.16.3, < 5.16.11 | 5.16.11 |