In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
misc: nsm: only unlock nsm_dev on post-lock error paths<\/p>\n
nsm_dev_ioctl() jumps to the common out label even when the initial
\ncopy_from_user() fails before nsm->lock has been taken. The error path
\nthen blindly unlocks a mutex that was never acquired.<\/p>\n
This issue was found by our static analysis tool and then manually
\nreviewed against the current tree.<\/p>\n
The grounded PoC kept the miscdevice ioctl entry and the pre-lock
\ncopy_from_user(&raw, argp, _IOC_SIZE(cmd)) failure path by issuing
\nNSM_IOCTL_RAW with an invalid user pointer. That failure reaches the
\nshared out label before mutex_lock(&nsm->lock). Lockdep reported:<\/p>\n
WARNING: bad unlock balance detected!
\n exploit\/193 is trying to release lock (&global_nsm.lock) at:
\n nsm_dev_ioctl+0x5f\/0xcf [vuln_msv]
\n but there are no more locks to release!
\n no locks held by exploit\/193.<\/p>\n
Return immediately on the pre-lock copy_from_user() failure and keep the
\ncommon unlock label for the post-lock paths only.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
misc: nsm: only unlock nsm_dev on post-lock error paths<\/p>\n
nsm_dev_ioctl() jumps to the common out label even when the initial
\ncopy_f<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-5373","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/5373","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=5373"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=5373"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=5373"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}