In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
iio: buffer: Fix potential use-after-free in anonymous buffer release<\/p>\n
An anonymous buffer handle holds a reference to the underlying IIO device.
\nThe reference is dropped in the buffer handle’s release function. If the
\ndevice has been removed, either through unbind or hot-unplug, the buffer
\nhandle might hold the last reference.<\/p>\n
The release function takes the mutex for the buffer using a guard, which
\nmeans the unlock happens after all the code in the function, including
\n`iio_device_put()`. If the anonymous buffer holds the last reference this
\nmight free both the IIO device and the buffer, which contains the mutex,
\nleading to use-after-free when the mutex is unlocked.<\/p>\n
Fix this by using a scoped guard just around the buffer dmabuf list access,
\nmaking sure the mutex is unlocked before releasing the IIO device.<\/p>\n
Version 10 of the patch that introduced this issue used this exact scheme
\nof first unlocking and then dropping the reference [1]. During review it
\nwas suggested to use a guard instead, and version 11 made that change [2].<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
iio: buffer: Fix potential use-after-free in anonymous buffer release<\/p>\n
An anonymous buffer handle holds a reference to the underlyi<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-24629","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/24629","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=24629"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=24629"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=24629"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}