Overview
About vulnerability
In the Linux kernel, the following vulnerability has been resolved:
iio: mma8452: Fix trigger reference couting
The mma8452 driver directly assigns a trigger to the struct iio_dev. The
IIO core when done using this trigger will call iio_trigger_put() to drop
the reference count by 1.
Without the matching iio_trigger_get() in the driver the reference count
can reach 0 too early, the trigger gets freed while still in use and a
use-after-free occurs.
Fix this by getting a reference to the trigger before assigning it to the IIO device.
Details
- Affected product:
- Ubuntu 16.04 ELS
- Affected packages:
- linux @ 4.4.0 (+1 more)
In the Linux kernel, the following vulnerability has been resolved:
iio: mma8452: Fix trigger reference couting
The mma8452 driver directly assigns a trigger to the struct iio_dev. The
IIO core when done using this trigger will call iio_trigger_put() to drop
the reference count by 1.
Without the matching iio_trigger_get() in the driver the reference count
can reach 0 too early, the trigger gets freed while still in use and a
use-after-free occurs.
Fix this by getting a reference to the trigger before assigning it to the IIO device.