In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
i3c: master: Fix info leak and UAF in device unregister path<\/p>\n
i3c_master_unregister_i3c_devs() clears i3cdev->dev->desc before
\ncalling device_unregister(). During device_unregister(),
\ndevice_del() emits a KOBJ_REMOVE uevent and unbinds the driver while
\nthe device descriptor is still expected to be valid. As a result,
\ni3c_device_uevent() and a racing modalias_show() can observe a NULL
\ndesc and fall back to an uninitialized stack struct i3c_device_info,
\nleaking kernel stack contents in the generated modalias. Driver
\n.remove() callbacks may also encounter an unexpected NULL desc during
\nunbind.<\/p>\n
Keep desc valid until device_unregister() has completed. Since
\ndevice_unregister() drops the device reference and may free the device,
\ntake an extra reference with get_device() before unregistering. Clear
\ndesc afterwards and release the extra reference with put_device().
\nThis preserves the release-time invariant that desc must be NULL while
\navoiding both the information leak and a potential use-after-free from
\nwriting desc after the device has been released.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
i3c: master: Fix info leak and UAF in device unregister path<\/p>\n
i3c_master_unregister_i3c_devs() clears i3cdev->dev->desc before
\ncall<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-21285","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/21285","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=21285"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=21285"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=21285"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}