In the Linux kernel, the following vulnerability has been resolved:
crypto: qat - Fix ADFDEVRESET_SYNC memory leak
Using completiondone to determine whether the caller has gone away only works after a complete call. Furthermore it's still possible that the caller has not yet called waitfor_completion, resulting in another potential UAF.
Fix this by making the caller use cancelworksync and then freeing the memory safely.
[ { "signature_type": "Function", "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3fb4601e0db10d4fe25e46f3fa308d40d37366bd", "signature_version": "v1", "target": { "function": "adf_dev_aer_schedule_reset", "file": "drivers/crypto/qat/qat_common/adf_aer.c" }, "digest": { "function_hash": "262250946718737681158353530917335326337", "length": 808.0 }, "id": "CVE-2024-39493-0139a345" }, { "signature_type": "Function", "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3fb4601e0db10d4fe25e46f3fa308d40d37366bd", "signature_version": "v1", "target": { "function": "adf_device_reset_worker", "file": "drivers/crypto/qat/qat_common/adf_aer.c" }, "digest": { "function_hash": "186867078374272925001587302598636995118", "length": 772.0 }, "id": "CVE-2024-39493-062c95a3" }, { "signature_type": "Function", "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6396b33e98c096bff9c253ed49c008247963492a", "signature_version": "v1", "target": { "function": "adf_device_reset_worker", "file": "drivers/crypto/qat/qat_common/adf_aer.c" }, "digest": { "function_hash": "186867078374272925001587302598636995118", "length": 772.0 }, "id": "CVE-2024-39493-0a4d8fb6" }, { "signature_type": "Function", "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e7428e7e3fe94a5089dc12ffe5bc31574d2315ad", "signature_version": "v1", "target": { "function": "adf_device_reset_worker", "file": "drivers/crypto/qat/qat_common/adf_aer.c" }, "digest": { "function_hash": "186867078374272925001587302598636995118", "length": 772.0 }, "id": "CVE-2024-39493-1234f559" }, { "signature_type": "Function", "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e7428e7e3fe94a5089dc12ffe5bc31574d2315ad", "signature_version": "v1", "target": { "function": "adf_dev_aer_schedule_reset", "file": "drivers/crypto/qat/qat_common/adf_aer.c" }, "digest": { "function_hash": "262250946718737681158353530917335326337", "length": 808.0 }, "id": "CVE-2024-39493-2c33de68" }, { "signature_type": "Function", "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c2d443aa1ae3175c13a665f3a24b8acd759ce9c3", "signature_version": "v1", "target": { "function": "adf_dev_aer_schedule_reset", "file": "drivers/crypto/intel/qat/qat_common/adf_aer.c" }, "digest": { "function_hash": "262250946718737681158353530917335326337", "length": 808.0 }, "id": "CVE-2024-39493-3d1093cb" }, { "signature_type": "Line", "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c2d443aa1ae3175c13a665f3a24b8acd759ce9c3", "signature_version": "v1", "target": { "file": "drivers/crypto/intel/qat/qat_common/adf_aer.c" }, "digest": { "threshold": 0.9, "line_hashes": [ "279821157705785024551250703058660347791", "249896411221451794868830096804141579390", "315695802712708881409657754598770453733", "253441460351423030397069668136029832720", "158924203570854844092319456995160376745", "35052383969873662052411346915633928131", "294752346965755555552323313500357734570", "312042685043771204954274028754715768830", "247554758999059202291633446110876396687", "336743051042188266159155393234392679447", "91991696426132706427743413930008685299", "180601683722982782397744260109971655611", "251711459152136417294972968227312460188", "23450251980028974326319729417842386064", "18520006588477713584506456566696525164", "314225762551684742192414404338734487519", "274294737711283130427019921766375630045", "73387194966348969081033652058695971271" ] }, "id": "CVE-2024-39493-3decaa89" }, { "signature_type": "Function", "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0ce5964b82f212f4df6a9813f09a0b5de15bd9c8", "signature_version": "v1", "target": { "function": "adf_dev_aer_schedule_reset", "file": "drivers/crypto/qat/qat_common/adf_aer.c" }, "digest": { "function_hash": "262250946718737681158353530917335326337", "length": 808.0 }, "id": "CVE-2024-39493-5433d546" }, { "signature_type": "Function", "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d0fd124972724cce0d48b9865ce3e273ef69e246", "signature_version": "v1", "target": { "function": "adf_dev_aer_schedule_reset", "file": "drivers/crypto/intel/qat/qat_common/adf_aer.c" }, "digest": { "function_hash": "262250946718737681158353530917335326337", "length": 808.0 }, "id": "CVE-2024-39493-544f0633" }, { "signature_type": "Line", "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3fb4601e0db10d4fe25e46f3fa308d40d37366bd", "signature_version": "v1", "target": { "file": "drivers/crypto/qat/qat_common/adf_aer.c" }, "digest": { "threshold": 0.9, "line_hashes": [ "12372666758329649019526119219986023495", "38288418513544283281588198468046579898", "315695802712708881409657754598770453733", "253441460351423030397069668136029832720", "158924203570854844092319456995160376745", "35052383969873662052411346915633928131", "294752346965755555552323313500357734570", "312042685043771204954274028754715768830", "247554758999059202291633446110876396687", "336743051042188266159155393234392679447", "91991696426132706427743413930008685299", "180601683722982782397744260109971655611", "251711459152136417294972968227312460188", "23450251980028974326319729417842386064", "18520006588477713584506456566696525164", "314225762551684742192414404338734487519", "274294737711283130427019921766375630045", "73387194966348969081033652058695971271" ] }, "id": "CVE-2024-39493-5844bf7b" }, { "signature_type": "Line", "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d3b17c6d9dddc2db3670bc9be628b122416a3d26", "signature_version": "v1", "target": { "file": "drivers/crypto/intel/qat/qat_common/adf_aer.c" }, "digest": { "threshold": 0.9, "line_hashes": [ "279821157705785024551250703058660347791", "249896411221451794868830096804141579390", "315695802712708881409657754598770453733", "253441460351423030397069668136029832720", "158924203570854844092319456995160376745", "186022306102280183963446507392625994647", "294752346965755555552323313500357734570", "312042685043771204954274028754715768830", "247554758999059202291633446110876396687", "336743051042188266159155393234392679447", "91991696426132706427743413930008685299", "180601683722982782397744260109971655611", "251711459152136417294972968227312460188", "23450251980028974326319729417842386064", "18520006588477713584506456566696525164", "314225762551684742192414404338734487519", "274294737711283130427019921766375630045", "73387194966348969081033652058695971271" ] }, "id": "CVE-2024-39493-5b22fc3a" }, { "signature_type": "Function", "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d0fd124972724cce0d48b9865ce3e273ef69e246", "signature_version": "v1", "target": { "function": "adf_device_reset_worker", "file": "drivers/crypto/intel/qat/qat_common/adf_aer.c" }, "digest": { "function_hash": "20825702579704690093409390814730686177", "length": 986.0 }, "id": "CVE-2024-39493-665727f3" }, { "signature_type": "Function", "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d3b17c6d9dddc2db3670bc9be628b122416a3d26", "signature_version": "v1", "target": { "function": "adf_dev_aer_schedule_reset", "file": "drivers/crypto/intel/qat/qat_common/adf_aer.c" }, "digest": { "function_hash": "262250946718737681158353530917335326337", "length": 808.0 }, "id": "CVE-2024-39493-7a6ba042" }, { "signature_type": "Line", "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e7428e7e3fe94a5089dc12ffe5bc31574d2315ad", "signature_version": "v1", "target": { "file": "drivers/crypto/qat/qat_common/adf_aer.c" }, "digest": { "threshold": 0.9, "line_hashes": [ "12372666758329649019526119219986023495", "38288418513544283281588198468046579898", "315695802712708881409657754598770453733", "253441460351423030397069668136029832720", "158924203570854844092319456995160376745", "35052383969873662052411346915633928131", "294752346965755555552323313500357734570", "312042685043771204954274028754715768830", "247554758999059202291633446110876396687", "336743051042188266159155393234392679447", "91991696426132706427743413930008685299", "180601683722982782397744260109971655611", "251711459152136417294972968227312460188", "23450251980028974326319729417842386064", "18520006588477713584506456566696525164", "314225762551684742192414404338734487519", "274294737711283130427019921766375630045", "73387194966348969081033652058695971271" ] }, "id": "CVE-2024-39493-7afc7435" }, { "signature_type": "Function", "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c2d443aa1ae3175c13a665f3a24b8acd759ce9c3", "signature_version": "v1", "target": { "function": "adf_device_reset_worker", "file": "drivers/crypto/intel/qat/qat_common/adf_aer.c" }, "digest": { "function_hash": "331380231693256705192803928614549296033", "length": 714.0 }, "id": "CVE-2024-39493-84ddadb1" }, { "signature_type": "Line", "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6396b33e98c096bff9c253ed49c008247963492a", "signature_version": "v1", "target": { "file": "drivers/crypto/qat/qat_common/adf_aer.c" }, "digest": { "threshold": 0.9, "line_hashes": [ "12372666758329649019526119219986023495", "38288418513544283281588198468046579898", "315695802712708881409657754598770453733", "253441460351423030397069668136029832720", "158924203570854844092319456995160376745", "35052383969873662052411346915633928131", "294752346965755555552323313500357734570", "312042685043771204954274028754715768830", "247554758999059202291633446110876396687", "336743051042188266159155393234392679447", "91991696426132706427743413930008685299", "180601683722982782397744260109971655611", "251711459152136417294972968227312460188", "23450251980028974326319729417842386064", "18520006588477713584506456566696525164", "314225762551684742192414404338734487519", "274294737711283130427019921766375630045", "73387194966348969081033652058695971271" ] }, "id": "CVE-2024-39493-872f4cd0" }, { "signature_type": "Function", "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a718b6d2a329e069b27d9049a71be5931e71d960", "signature_version": "v1", "target": { "function": "adf_device_reset_worker", "file": "drivers/crypto/qat/qat_common/adf_aer.c" }, "digest": { "function_hash": "186867078374272925001587302598636995118", "length": 772.0 }, "id": "CVE-2024-39493-a0ea190a" }, { "signature_type": "Line", "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d0fd124972724cce0d48b9865ce3e273ef69e246", "signature_version": "v1", "target": { "file": "drivers/crypto/intel/qat/qat_common/adf_aer.c" }, "digest": { "threshold": 0.9, "line_hashes": [ "279821157705785024551250703058660347791", "249896411221451794868830096804141579390", "315695802712708881409657754598770453733", "253441460351423030397069668136029832720", "158924203570854844092319456995160376745", "186022306102280183963446507392625994647", "294752346965755555552323313500357734570", "312042685043771204954274028754715768830", "247554758999059202291633446110876396687", "336743051042188266159155393234392679447", "91991696426132706427743413930008685299", "180601683722982782397744260109971655611", "251711459152136417294972968227312460188", "23450251980028974326319729417842386064", "18520006588477713584506456566696525164", "314225762551684742192414404338734487519", "274294737711283130427019921766375630045", "73387194966348969081033652058695971271" ] }, "id": "CVE-2024-39493-a58e4b3e" }, { "signature_type": "Function", "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0ce5964b82f212f4df6a9813f09a0b5de15bd9c8", "signature_version": "v1", "target": { "function": "adf_device_reset_worker", "file": "drivers/crypto/qat/qat_common/adf_aer.c" }, "digest": { "function_hash": "186867078374272925001587302598636995118", "length": 772.0 }, "id": "CVE-2024-39493-b67e7a2a" }, { "signature_type": "Function", "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d3b17c6d9dddc2db3670bc9be628b122416a3d26", "signature_version": "v1", "target": { "function": "adf_device_reset_worker", "file": "drivers/crypto/intel/qat/qat_common/adf_aer.c" }, "digest": { "function_hash": "20825702579704690093409390814730686177", "length": 986.0 }, "id": "CVE-2024-39493-c28a5f77" }, { "signature_type": "Line", "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a718b6d2a329e069b27d9049a71be5931e71d960", "signature_version": "v1", "target": { "file": "drivers/crypto/qat/qat_common/adf_aer.c" }, "digest": { "threshold": 0.9, "line_hashes": [ "12372666758329649019526119219986023495", "38288418513544283281588198468046579898", "315695802712708881409657754598770453733", "253441460351423030397069668136029832720", "158924203570854844092319456995160376745", "35052383969873662052411346915633928131", "294752346965755555552323313500357734570", "312042685043771204954274028754715768830", "247554758999059202291633446110876396687", "336743051042188266159155393234392679447", "91991696426132706427743413930008685299", "180601683722982782397744260109971655611", "251711459152136417294972968227312460188", "23450251980028974326319729417842386064", "18520006588477713584506456566696525164", "314225762551684742192414404338734487519", "274294737711283130427019921766375630045", "73387194966348969081033652058695971271" ] }, "id": "CVE-2024-39493-ee89c5a8" }, { "signature_type": "Function", "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6396b33e98c096bff9c253ed49c008247963492a", "signature_version": "v1", "target": { "function": "adf_dev_aer_schedule_reset", "file": "drivers/crypto/qat/qat_common/adf_aer.c" }, "digest": { "function_hash": "262250946718737681158353530917335326337", "length": 808.0 }, "id": "CVE-2024-39493-f502901d" }, { "signature_type": "Function", "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a718b6d2a329e069b27d9049a71be5931e71d960", "signature_version": "v1", "target": { "function": "adf_dev_aer_schedule_reset", "file": "drivers/crypto/qat/qat_common/adf_aer.c" }, "digest": { "function_hash": "262250946718737681158353530917335326337", "length": 808.0 }, "id": "CVE-2024-39493-fa0df99a" }, { "signature_type": "Line", "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0ce5964b82f212f4df6a9813f09a0b5de15bd9c8", "signature_version": "v1", "target": { "file": "drivers/crypto/qat/qat_common/adf_aer.c" }, "digest": { "threshold": 0.9, "line_hashes": [ "12372666758329649019526119219986023495", "38288418513544283281588198468046579898", "315695802712708881409657754598770453733", "253441460351423030397069668136029832720", "158924203570854844092319456995160376745", "35052383969873662052411346915633928131", "294752346965755555552323313500357734570", "312042685043771204954274028754715768830", "247554758999059202291633446110876396687", "336743051042188266159155393234392679447", "91991696426132706427743413930008685299", "180601683722982782397744260109971655611", "251711459152136417294972968227312460188", "23450251980028974326319729417842386064", "18520006588477713584506456566696525164", "314225762551684742192414404338734487519", "274294737711283130427019921766375630045", "73387194966348969081033652058695971271" ] }, "id": "CVE-2024-39493-fdf12c06" } ]