In the Linux kernel, the following vulnerability has been resolved:
net:emac/emac-mac: Fix a use after free in emac_mac_tx_buf_send
In emac_mac_tx_buf_send, it calls emac_tx_fill_tpd(…,skb,…).
If some error happens in emac_tx_fill_tpd(), the skb will be freed via
dev_kfree_skb(skb) in error branch of emac_tx_fill_tpd().
But the freed skb is still used via skb->len by netdev_sent_queue(,skb->len).
As i observed that emac_tx_fill_tpd() haven’t modified the value of skb->len,
thus my patch assigns skb->len to ‘len’ before the possible free and
use ‘len’ instead of skb->len later.
Vendor | Product | Version | CPE |
---|---|---|---|
linux | linux_kernel | * | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
[
{
"product": "Linux",
"vendor": "Linux",
"defaultStatus": "unaffected",
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"programFiles": [
"drivers/net/ethernet/qualcomm/emac/emac-mac.c"
],
"versions": [
{
"version": "b9b17debc69d",
"lessThan": "c7f75d11fe72",
"status": "affected",
"versionType": "git"
},
{
"version": "b9b17debc69d",
"lessThan": "dc1b438a3577",
"status": "affected",
"versionType": "git"
},
{
"version": "b9b17debc69d",
"lessThan": "16d8c44be52e",
"status": "affected",
"versionType": "git"
},
{
"version": "b9b17debc69d",
"lessThan": "55fcdd1258fa",
"status": "affected",
"versionType": "git"
},
{
"version": "b9b17debc69d",
"lessThan": "9dc373f74097",
"status": "affected",
"versionType": "git"
},
{
"version": "b9b17debc69d",
"lessThan": "8c06f3478506",
"status": "affected",
"versionType": "git"
},
{
"version": "b9b17debc69d",
"lessThan": "e407495ba678",
"status": "affected",
"versionType": "git"
},
{
"version": "b9b17debc69d",
"lessThan": "6d72e7c767ac",
"status": "affected",
"versionType": "git"
}
]
},
{
"product": "Linux",
"vendor": "Linux",
"defaultStatus": "affected",
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"programFiles": [
"drivers/net/ethernet/qualcomm/emac/emac-mac.c"
],
"versions": [
{
"version": "4.9",
"status": "affected"
},
{
"version": "0",
"lessThan": "4.9",
"status": "unaffected",
"versionType": "custom"
},
{
"version": "4.9.269",
"lessThanOrEqual": "4.9.*",
"status": "unaffected",
"versionType": "custom"
},
{
"version": "4.14.233",
"lessThanOrEqual": "4.14.*",
"status": "unaffected",
"versionType": "custom"
},
{
"version": "4.19.191",
"lessThanOrEqual": "4.19.*",
"status": "unaffected",
"versionType": "custom"
},
{
"version": "5.4.119",
"lessThanOrEqual": "5.4.*",
"status": "unaffected",
"versionType": "custom"
},
{
"version": "5.10.37",
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"versionType": "custom"
},
{
"version": "5.11.21",
"lessThanOrEqual": "5.11.*",
"status": "unaffected",
"versionType": "custom"
},
{
"version": "5.12.4",
"lessThanOrEqual": "5.12.*",
"status": "unaffected",
"versionType": "custom"
},
{
"version": "5.13",
"lessThanOrEqual": "*",
"status": "unaffected",
"versionType": "original_commit_for_fix"
}
]
}
]
git.kernel.org/stable/c/16d8c44be52e3650917736d45f5904384a9da834
git.kernel.org/stable/c/55fcdd1258faaecca74b91b88cc0921f9edd775d
git.kernel.org/stable/c/6d72e7c767acbbdd44ebc7d89c6690b405b32b57
git.kernel.org/stable/c/8c06f34785068b87e2b560534c77c163d6c6dca7
git.kernel.org/stable/c/9dc373f74097edd0e35f3393d6248eda8d1ba99d
git.kernel.org/stable/c/c7f75d11fe72913d2619f97b2334b083cd7bb955
git.kernel.org/stable/c/dc1b438a35773d030be0ee80d9c635c3e558a322
git.kernel.org/stable/c/e407495ba6788a67d1bd41714158c079e340879b