In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
media: cec: disable delayed work before freeing an interrupted transmit<\/p>\n
cec_transmit_msg_fh() drops adap->lock to wait for a blocking transmit in
\nwait_for_completion_killable(). If that wait is interrupted by a signal,
\ncancel_delayed_work_sync() can run before the CEC kthread arms the reply
\ntimeout via schedule_delayed_work(&data->work) in cec_transmit_done_ts().
\nThe work is then armed after the cancel, and the data is freed with its
\ndelayed_work still pending:<\/p>\n
ODEBUG: free active (active state 0) object: … hint: cec_wait_timeout<\/p>\n
Use disable_delayed_work_sync(): it cancels the work and disables it, so
\nthe later schedule_delayed_work() becomes a no-op and the work cannot be
\nre-armed. The data is freed right after, so it need not be re-enabled.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
media: cec: disable delayed work before freeing an interrupted transmit<\/p>\n
cec_transmit_msg_fh() drops adap->lock to wait for a block<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-24586","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/24586","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=24586"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=24586"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=24586"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}