Bug 2298123 (CVE-2022-48787) - CVE-2022-48787 kernel: iwlwifi: fix use-after-free
Summary: CVE-2022-48787 kernel: iwlwifi: fix use-after-free
Keywords:
Status: NEW
Alias: CVE-2022-48787
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Product Security DevOps Team
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2024-07-16 12:25 UTC by OSIDB Bzimport
Modified: 2025-03-31 22:29 UTC (History)
4 users (show)

Fixed In Version: kernel 4.14.268, kernel 4.19.231, kernel 5.4.181, kernel 5.10.102, kernel 5.15.25, kernel 5.16.11
Clone Of:
Environment:
Last Closed:
Embargoed:


Attachments (Terms of Use)

Description OSIDB Bzimport 2024-07-16 12:25:08 UTC
In the Linux kernel, the following vulnerability has been resolved:

iwlwifi: fix use-after-free

If no firmware was present at all (or, presumably, all of the
firmware files failed to parse), we end up unbinding by calling
device_release_driver(), which calls remove(), which then in
iwlwifi calls iwl_drv_stop(), freeing the 'drv' struct. However
the new code I added will still erroneously access it after it
was freed.

Set 'failure=false' in this case to avoid the access, all data
was already freed anyway.


Note You need to log in before you can comment on or make changes to this bug.