Overview
About vulnerability
In the Linux kernel, the following vulnerability has been resolved:
iio: adc: at91-sama5d2_adc: Fix potential use-after-free in sama5d2_adc driver
at91_adc_interrupt can call at91_adc_touch_data_handler function to start the work by schedule_work(&st->touch_st.workq).
If we remove the module which will call at91_adc_remove to make cleanup, it will free indio_dev through iio_device_unregister but quite a bit later. While the work mentioned above will be used. The sequence of operations that may lead to a UAF bug is as follows:
CPU0 CPU1
| at91_adc_workq_handler at91_adc_remove | iio_device_unregister(indio_dev) | //free indio_dev a bit later | | iio_push_to_buffers(indio_dev) | //use indio_dev
Fix it by ensuring that the work is canceled before proceeding with the cleanup in at91_adc_remove.
Details
- Affected product:
- Ubuntu 20.04 ELS
- Affected packages:
- linux @ 5.4.0
Fixes
KernelCare state
Live-patch status from KernelCare for each operating system.
| Operating system | Status | Covered kernels |
|---|---|---|
| Debian 11 | Will Not Fix | — |
| Debian 11 cloud | Will Not Fix | — |
| Debian 12 | Planned | — |
| Debian 13 | Planned | — |
| Proxmox VE 7 5.15 | Released |
47 kernels
|
| Ubuntu 20.04 HWE AWS | Released |
57 kernels
|
| Ubuntu 20.04 HWE Azure | Released |
40 kernels
|
| Ubuntu 22.04 | Released |
92 kernels
|
| Ubuntu 22.04 AWS | Released |
83 kernels
|
| Ubuntu 22.04 Azure | Released |
74 kernels
|
| Ubuntu 24.04 | Released |
43 kernels
|
| Ubuntu 24.04 AWS | Planned | — |