In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
ipack: ipoctal: fix UAF, null-ptr-deref, and use-after-free in cleanup on remove<\/p>\n
Three issues arise when the device is removed while a tty session is
\nstill active:<\/p>\n
1. UAF of struct ipoctal: the remove callback frees ipoctal via
\n kfree() while tty ops may still access it. Fix by introducing
\n kref-based lifetime management \u2014 kref is taken in install() when
\n a tty is opened and released in cleanup() when the tty is finally
\n destroyed; remove() uses kref_put() instead of kfree().<\/p>\n
2. NULL dereference in ipoctal_write_tty(): __ipoctal_remove()
\n frees xmit_buf via tty_port_free_xmit_buf() while a userspace
\n process may still hold the tty fd and call write(). Fix by
\n checking for NULL xmit_buf in ipoctal_write_tty().<\/p>\n
3. UAF in ipoctal_cleanup(): ipack_put_carrier(ipoctal->dev)
\n dereferences ipoctal->dev after the ipack_device has been freed
\n by ipack_device_del(). Fix by caching ipoctal->carrier_owner
\n during probe() and calling module_put() on the cached pointer
\n directly in cleanup(), avoiding any access to ipoctal->dev.<\/p>\n
Also introduce a “removed” flag in struct ipoctal, set at the start
\nof __ipoctal_remove(), and checked in every tty op that accesses
\nhardware resources (port_activate, write_tty, set_termios, hangup,
\nshutdown). This prevents page faults when devm_ioremap() regions
\nare unmapped after remove() returns.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
ipack: ipoctal: fix UAF, null-ptr-deref, and use-after-free in cleanup on remove<\/p>\n
Three issues arise when the device is removed whi<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-25909","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/25909","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=25909"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=25909"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=25909"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}