Medium · published July 10, 2024
In the Linux kernel, the following vulnerability has been resolved:
crypto: qat - Fix ADF_DEV_RESET_SYNC memory leak
Using completion_done to determine whether the caller has gone
away only works after a complete call. Furthermore it's still
possible that the caller has not yet called wait_for_completion,
resulting in another potential UAF.
Fix this by making the caller use cancel_work_sync and then freeing
the memory safely.
| Product | Versions | Fixed in |
|---|---|---|
| linux/linux_kernel | ≥ 4.19.312, < 4.19.316 | 4.19.316 |
| linux/linux_kernel | ≥ 5.4.274, < 5.4.278 | 5.4.278 |
| linux/linux_kernel | ≥ 5.10.215, < 5.10.219 | 5.10.219 |
| linux/linux_kernel | ≥ 5.15.154, < 5.15.161 | 5.15.161 |
| linux/linux_kernel | ≥ 6.1.84, < 6.1.94 | 6.1.94 |
| linux/linux_kernel | ≥ 6.6.24, < 6.6.34 | 6.6.34 |
| linux/linux_kernel | ≥ 6.9, < 6.9.5 | 6.9.5 |