In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
HID: uclogic: fix use-after-free of inrange_timer on remove<\/p>\n
uclogic_remove() cancels the pen in-range timer and then stops the
\ndevice:<\/p>\n
\ttimer_delete_sync(&drvdata->inrange_timer);
\n\thid_hw_stop(hdev);<\/p>\n
timer_delete_sync() only guarantees the timer is idle at that instant.
\nuclogic_raw_event_pen() keeps delivering pen reports until hid_hw_stop()
\nstops the transport several lines later, and every report with
\npen->inrange == UCLOGIC_PARAMS_PEN_INRANGE_NONE re-arms the timer:<\/p>\n
\tmod_timer(&drvdata->inrange_timer, jiffies + msecs_to_jiffies(100));<\/p>\n
A report landing between the timer_delete_sync() call and the transport
\nteardown in hid_hw_stop() re-arms inrange_timer after it was cancelled.
\nuclogic_remove() then returns and the devm drvdata is freed, while
\nhid_hw_stop() has already freed the input device drvdata->pen_input
\npoints at, so when the timer fires ~100 ms later
\nuclogic_inrange_timeout() dereferences freed memory — a use-after-free
\nin timer-softirq context.<\/p>\n
Swapping the two calls is not a fix: stopping the device first frees
\ndrvdata->pen_input via hidinput_disconnect() while the timer may still
\nbe pending, so a timer already armed before removal fires on the freed
\ninput device in the window before timer_delete_sync() runs.<\/p>\n
Use timer_shutdown_sync() before hid_hw_stop() instead. It cancels the
\ntimer, waits for a running callback while pen_input is still valid, and
\nprevents any further re-arming — a later mod_timer() from an in-flight
\nreport is silently ignored — so the timer is provably dead before
\nhid_hw_stop() frees the inputs. This is the ordering the timer core
\ndocuments for this “timer re-armed from another path” teardown case.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
HID: uclogic: fix use-after-free of inrange_timer on remove<\/p>\n
uclogic_remove() cancels the pen in-range timer and then stops the
\ndev<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-17270","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/17270","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=17270"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=17270"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=17270"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}