CVE-2024-27043
Assigner: Linux
Published: 2024-05-01T12:54:11.197Z
State: PUBLISHED
descriptions: value: In the Linux kernel, the following vulnerability has been resolved:

media: edia: dvbdev: fix a use-after-free

In dvb_register_device, *pdvbdev is set equal to dvbdev, which is freed
in several error-handling paths. However, *pdvbdev is not set to NULL
after dvbdev's deallocation, causing use-after-frees in many places,
for example, in the following call chain:

budget_register
  |-> dvb_dmxdev_init
        |-> dvb_register_device
  |-> dvb_dmxdev_release
        |-> dvb_unregister_device
              |-> dvb_remove_device
                    |-> dvb_device_put
                          |-> kref_put

When calling dvb_unregister_device, dmxdev->dvbdev (i.e. *pdvbdev in
dvb_register_device) could point to memory that had been freed in
dvb_register_device. Thereafter, this pointer is transferred to
kref_put and triggering a use-after-free.
affected: product: Linux
vendor: Linux
defaultStatus: unaffected
repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
versions: version: b61901024776
lessThan: d0f5c2833382
status: affected
versionType: git
version: b61901024776
lessThan: f20c3270f3ed
status: affected
versionType: git
version: b61901024776
lessThan: 096237039d00
status: affected
versionType: git
version: b61901024776
lessThan: 0d3fe80b6d17
status: affected
versionType: git
version: b61901024776
lessThan: 437a111f79a2
status: affected
versionType: git
version: b61901024776
lessThan: 779e8db7efb2
status: affected
versionType: git
version: b61901024776
lessThan: 35674111a043
status: affected
versionType: git
version: b61901024776
lessThan: b7586e902128
status: affected
versionType: git
version: b61901024776
lessThan: 8c64f4cdf4e6
status: affected
versionType: git
product: Linux
vendor: Linux
defaultStatus: affected
repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
versions: version: 2.6.21
status: affected
version: 0
lessThan: 2.6.21
status: unaffected
versionType: custom
version: 4.19.311
lessThanOrEqual: 4.19.*
status: unaffected
versionType: custom
version: 5.4.273
lessThanOrEqual: 5.4.*
status: unaffected
versionType: custom
version: 5.10.214
lessThanOrEqual: 5.10.*
status: unaffected
versionType: custom
version: 5.15.153
lessThanOrEqual: 5.15.*
status: unaffected
versionType: custom
version: 6.1.83
lessThanOrEqual: 6.1.*
status: unaffected
versionType: custom
version: 6.6.23
lessThanOrEqual: 6.6.*
status: unaffected
versionType: custom
version: 6.7.11
lessThanOrEqual: 6.7.*
status: unaffected
versionType: custom
version: 6.8.2
lessThanOrEqual: 6.8.*
status: unaffected
versionType: custom
version: 6.9
lessThanOrEqual: *
status: unaffected
versionType: original_commit_for_fix
title: media: edia: dvbdev: fix a use-after-free
x_generator: engine: bippy-d175d3acf727