In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
uio: Fix stale info pointer in failed registration path<\/p>\n
After device_add(), the UIO device is visible to userspace and \/dev\/uioX
\ncan be opened. If a later setup step fails, __uio_register_device()
\nunwinds the device but leaves idev->info pointing at the caller-owned
\nstruct uio_info.<\/p>\n
That is unsafe when an opener races with the failed registration path.
\nThe open file keeps a reference to the uio_device, while the caller sees
\nregistration failure and may free its struct uio_info. Later file
\noperations can then follow idev->info and dereference freed memory.<\/p>\n
Handle post-device_add() failures like unregister: remove UIO attributes
\nwhile the info pointer is still valid, then clear idev->info under
\ninfo_lock and wake existing waiters\/async users before removing the
\ndevice and minor. This makes already-open file descriptors observe the
\nsame “device gone” state as normal uio_unregister_device().<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
uio: Fix stale info pointer in failed registration path<\/p>\n
After device_add(), the UIO device is visible to userspace and \/dev\/uioX
\nc<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-25913","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/25913","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=25913"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=25913"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=25913"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}