Описание
In the Linux kernel, the following vulnerability has been resolved:
dmaengine: Fix possible use after free
In dma_release_channel(), check chan->device->privatecnt after call
dma_chan_put(). However, dma_chan_put() call dma_device_put() which could
release the last reference of the device if the DMA provider is already
gone and hence free it.
Fixes it by moving dma_chan_put() after the check.
A flaw was found in the dmaengine component of the Linux kernel. This flaw occurs in the dma_release_channel() function due to an incorrect order of operations, where a channel's reference count is decremented before verifying if the device is still in use. This can lead to a use-after-free vulnerability, potentially causing system instability or a denial of service.
Отчет
A moderate use-after-free flaw was found in the dmaengine subsystem of the Linux kernel as shipped in Red Hat Enterprise Linux and Red Hat In-Vehicle OS. In dma_release_channel(), the code calls dma_chan_put() before checking chan->device->privatecnt. dma_chan_put() calls dma_device_put(), which can drop the last reference to the DMA device when the DMA provider is already gone, causing the device object to be freed while the subsequent privatecnt check still dereferences it. A local user able to trigger the release of a DMA channel during provider teardown could exploit this use-after-free to crash the kernel, resulting in a denial of service; in the worst case, memory corruption from the use of the freed device object could have broader consequences. Red Hat has rated this flaw as having MODERATE impact (CVSS 5.5, AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) because exploitation requires local access to the DMA channel release path and the primary practical consequence is a kernel panic. This is lower than the upstream CVEORG score of 7.8, which additionally assumes high confidentiality and integrity impact from the memory corruption. The kernel and kernel-rt components in Red Hat Enterprise Linux 7, 8, 9, and 10, and the kernel and kernel-ivos-qualcomm components in Red Hat In-Vehicle OS 2, are affected. Fixes for these streams have been deferred and are planned for a future update; until then, the residual risk is primarily local denial of service via a kernel crash. Red Hat Enterprise Linux 6 Extended Lifecycle Support is out of support scope and will not receive a fix.
Меры по смягчению последствий
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 10 | kernel | Fix deferred | ||
| Red Hat Enterprise Linux 6 | kernel | Out of support scope | ||
| Red Hat Enterprise Linux 7 | kernel | Fix deferred | ||
| Red Hat Enterprise Linux 7 | kernel-rt | Fix deferred | ||
| Red Hat Enterprise Linux 8 | kernel | Fix deferred | ||
| Red Hat Enterprise Linux 8 | kernel-rt | Fix deferred | ||
| Red Hat Enterprise Linux 9 | kernel | Fix deferred | ||
| Red Hat Enterprise Linux 9 | kernel-rt | Fix deferred |
Показывать по
Дополнительная информация
Статус:
EPSS
5.5 Medium
CVSS3
Связанные уязвимости
In the Linux kernel, the following vulnerability has been resolved: dmaengine: Fix possible use after free In dma_release_channel(), check chan->device->privatecnt after call dma_chan_put(). However, dma_chan_put() call dma_device_put() which could release the last reference of the device if the DMA provider is already gone and hence free it. Fixes it by moving dma_chan_put() after the check.
In the Linux kernel, the following vulnerability has been resolved: dmaengine: Fix possible use after free In dma_release_channel(), check chan->device->privatecnt after call dma_chan_put(). However, dma_chan_put() call dma_device_put() which could release the last reference of the device if the DMA provider is already gone and hence free it. Fixes it by moving dma_chan_put() after the check.
In the Linux kernel, the following vulnerability has been resolved: d ...
EPSS
5.5 Medium
CVSS3