Overview
About vulnerability
In the Linux kernel, the following vulnerability has been resolved:
mei: bus: access mei_device under device_lock on cleanup
Fix couple of problems in mei_cl_bus_dev_release():
mei_cl_flush_queues() is running without lock. bus->file_list access after mei_dev_bus_put(bus) can become a use-after-free if this was the last reference to bus.
Protect queues cleanup and WARN traversal by device lock there to avoid the concurrent access problems. Move WARN traversal before mei_dev_bus_put(bus).
This file uses bus variable name for mei_device, adjust code of mei_cl_bus_dev_release() to use bus variable too.
Details
- Affected product:
- AlmaLinux 9.2 ESU , Debian 10 ELS , TuxCare 9.6 ESU
- Affected packages:
- kernel @ 5.14.0 (+2 more)