High · published February 26, 2024
In the Linux kernel, the following vulnerability has been resolved:
drivers/amd/pm: fix a use-after-free in kv_parse_power_table
When ps allocated by kzalloc equals to NULL, kv_parse_power_table
frees adev->pm.dpm.ps that allocated before. However, after the control
flow goes through the following call chains:
kv_parse_power_table
|-> kv_dpm_init
|-> kv_dpm_sw_init
|-> kv_dpm_fini
The adev->pm.dpm.ps is used in the for loop of kv_dpm_fini after its
first free in kv_parse_power_table and causes a use-after-free bug.
| Product | Versions | Fixed in |
|---|---|---|
| linux/linux_kernel | ≥ 4.2.0, < 4.19.306 | 4.19.306 |
| linux/linux_kernel | ≥ 4.20.0, < 5.4.268 | 5.4.268 |
| linux/linux_kernel | ≥ 5.5.0, < 5.10.209 | 5.10.209 |
| linux/linux_kernel | ≥ 5.11.0, < 5.15.148 | 5.15.148 |
| linux/linux_kernel | ≥ 5.16.0, < 6.1.75 | 6.1.75 |
| linux/linux_kernel | ≥ 6.2.0, < 6.6.14 | 6.6.14 |
| linux/linux_kernel | ≥ 6.7.0, < 6.7.2 | 6.7.2 |