In the Linux kernel, the following vulnerability has been resolved: HID: intel-ish-hid: Fix use-after-free issue in hidishtpclremove() During the rmmod
operation for the intel_ishtp_hid
driver, a use-after-free issue can occur in the hidishtpclremove() function. The function hidishtpcldeinit() is called before ishtphidremove(), which can lead to accessing freed memory or resources during the removal process. Call Trace: ? ishtpclsend+0x168/0x220 [intelishtp] ? hidoutputreport+0xe3/0x150 [hid] hidishtpsetfeature+0xb5/0x120 [intelishtphid] ishtphidrequest+0x7b/0xb0 [intelishtphid] hidhwrequest+0x1f/0x40 [hid] sensorhubsetfeature+0x11f/0x190 [hidsensorhub] hidsensorpowerstate+0x147/0x1e0 [hidsensortrigger] hidsensorruntimeresume+0x22/0x30 [hidsensortrigger] sensorhubremove+0xa8/0xe0 [hidsensorhub] hiddeviceremove+0x49/0xb0 [hid] hiddestroydevice+0x6f/0x90 [hid] ishtphidremove+0x42/0x70 [intelishtphid] hidishtpclremove+0x6b/0xb0 [intelishtphid] ishtpcldeviceremove+0x4a/0x60 [intelishtp] ... Additionally, ishtphidremove() is a HID level power off, which should occur before the ISHTP level disconnect. This patch resolves the issue by reordering the calls in hidishtpclremove(). The function ishtphidremove() is now called before hidishtpcldeinit().
{ "availability": "No subscription required", "binaries": [ { "binary_name": "linux-azure-6.11-cloud-tools-6.11.0-1018", "binary_version": "6.11.0-1018.18~24.04.1" }, { "binary_name": "linux-azure-6.11-headers-6.11.0-1018", "binary_version": "6.11.0-1018.18~24.04.1" }, { "binary_name": "linux-azure-6.11-tools-6.11.0-1018", "binary_version": "6.11.0-1018.18~24.04.1" }, { "binary_name": "linux-buildinfo-6.11.0-1018-azure", "binary_version": "6.11.0-1018.18~24.04.1" }, { "binary_name": "linux-cloud-tools-6.11.0-1018-azure", "binary_version": "6.11.0-1018.18~24.04.1" }, { "binary_name": "linux-headers-6.11.0-1018-azure", "binary_version": "6.11.0-1018.18~24.04.1" }, { "binary_name": "linux-image-unsigned-6.11.0-1018-azure", "binary_version": "6.11.0-1018.18~24.04.1" }, { "binary_name": "linux-image-unsigned-6.11.0-1018-azure-dbgsym", "binary_version": "6.11.0-1018.18~24.04.1" }, { "binary_name": "linux-modules-6.11.0-1018-azure", "binary_version": "6.11.0-1018.18~24.04.1" }, { "binary_name": "linux-modules-extra-6.11.0-1018-azure", "binary_version": "6.11.0-1018.18~24.04.1" }, { "binary_name": "linux-modules-iwlwifi-6.11.0-1018-azure", "binary_version": "6.11.0-1018.18~24.04.1" }, { "binary_name": "linux-tools-6.11.0-1018-azure", "binary_version": "6.11.0-1018.18~24.04.1" } ] }
{ "availability": "No subscription required", "binaries": [ { "binary_name": "linux-buildinfo-6.11.0-1016-gcp", "binary_version": "6.11.0-1016.16~24.04.1" }, { "binary_name": "linux-buildinfo-6.11.0-1016-gcp-64k", "binary_version": "6.11.0-1016.16~24.04.1" }, { "binary_name": "linux-gcp-6.11-headers-6.11.0-1016", "binary_version": "6.11.0-1016.16~24.04.1" }, { "binary_name": "linux-gcp-6.11-lib-rust-6.11.0-1016-gcp", "binary_version": "6.11.0-1016.16~24.04.1" }, { "binary_name": "linux-gcp-6.11-tools-6.11.0-1016", "binary_version": "6.11.0-1016.16~24.04.1" }, { "binary_name": "linux-headers-6.11.0-1016-gcp", "binary_version": "6.11.0-1016.16~24.04.1" }, { "binary_name": "linux-headers-6.11.0-1016-gcp-64k", "binary_version": "6.11.0-1016.16~24.04.1" }, { "binary_name": "linux-image-unsigned-6.11.0-1016-gcp", "binary_version": "6.11.0-1016.16~24.04.1" }, { "binary_name": "linux-image-unsigned-6.11.0-1016-gcp-64k", "binary_version": "6.11.0-1016.16~24.04.1" }, { "binary_name": "linux-image-unsigned-6.11.0-1016-gcp-64k-dbgsym", "binary_version": "6.11.0-1016.16~24.04.1" }, { "binary_name": "linux-image-unsigned-6.11.0-1016-gcp-dbgsym", "binary_version": "6.11.0-1016.16~24.04.1" }, { "binary_name": "linux-modules-6.11.0-1016-gcp", "binary_version": "6.11.0-1016.16~24.04.1" }, { "binary_name": "linux-modules-6.11.0-1016-gcp-64k", "binary_version": "6.11.0-1016.16~24.04.1" }, { "binary_name": "linux-modules-extra-6.11.0-1016-gcp", "binary_version": "6.11.0-1016.16~24.04.1" }, { "binary_name": "linux-modules-extra-6.11.0-1016-gcp-64k", "binary_version": "6.11.0-1016.16~24.04.1" }, { "binary_name": "linux-tools-6.11.0-1016-gcp", "binary_version": "6.11.0-1016.16~24.04.1" }, { "binary_name": "linux-tools-6.11.0-1016-gcp-64k", "binary_version": "6.11.0-1016.16~24.04.1" } ] }
{ "availability": "No subscription required", "binaries": [ { "binary_name": "linux-buildinfo-6.11.0-28-generic", "binary_version": "6.11.0-28.28~24.04.1" }, { "binary_name": "linux-buildinfo-6.11.0-28-generic-64k", "binary_version": "6.11.0-28.28~24.04.1" }, { "binary_name": "linux-cloud-tools-6.11.0-28-generic", "binary_version": "6.11.0-28.28~24.04.1" }, { "binary_name": "linux-headers-6.11.0-28-generic", "binary_version": "6.11.0-28.28~24.04.1" }, { "binary_name": "linux-headers-6.11.0-28-generic-64k", "binary_version": "6.11.0-28.28~24.04.1" }, { "binary_name": "linux-hwe-6.11-cloud-tools-6.11.0-28", "binary_version": "6.11.0-28.28~24.04.1" }, { "binary_name": "linux-hwe-6.11-headers-6.11.0-28", "binary_version": "6.11.0-28.28~24.04.1" }, { "binary_name": "linux-hwe-6.11-lib-rust-6.11.0-28-generic", "binary_version": "6.11.0-28.28~24.04.1" }, { "binary_name": "linux-hwe-6.11-tools-6.11.0-28", "binary_version": "6.11.0-28.28~24.04.1" }, { "binary_name": "linux-image-6.11.0-28-generic", "binary_version": "6.11.0-28.28~24.04.1" }, { "binary_name": "linux-image-6.11.0-28-generic-dbgsym", "binary_version": "6.11.0-28.28~24.04.1" }, { "binary_name": "linux-image-unsigned-6.11.0-28-generic", "binary_version": "6.11.0-28.28~24.04.1" }, { "binary_name": "linux-image-unsigned-6.11.0-28-generic-64k", "binary_version": "6.11.0-28.28~24.04.1" }, { "binary_name": "linux-image-unsigned-6.11.0-28-generic-64k-dbgsym", "binary_version": "6.11.0-28.28~24.04.1" }, { "binary_name": "linux-image-unsigned-6.11.0-28-generic-dbgsym", "binary_version": "6.11.0-28.28~24.04.1" }, { "binary_name": "linux-modules-6.11.0-28-generic", "binary_version": "6.11.0-28.28~24.04.1" }, { "binary_name": "linux-modules-6.11.0-28-generic-64k", "binary_version": "6.11.0-28.28~24.04.1" }, { "binary_name": "linux-modules-extra-6.11.0-28-generic", "binary_version": "6.11.0-28.28~24.04.1" }, { "binary_name": "linux-modules-ipu6-6.11.0-28-generic", "binary_version": "6.11.0-28.28~24.04.1" }, { "binary_name": "linux-modules-ipu7-6.11.0-28-generic", "binary_version": "6.11.0-28.28~24.04.1" }, { "binary_name": "linux-modules-iwlwifi-6.11.0-28-generic", "binary_version": "6.11.0-28.28~24.04.1" }, { "binary_name": "linux-modules-usbio-6.11.0-28-generic", "binary_version": "6.11.0-28.28~24.04.1" }, { "binary_name": "linux-modules-vision-6.11.0-28-generic", "binary_version": "6.11.0-28.28~24.04.1" }, { "binary_name": "linux-tools-6.11.0-28-generic", "binary_version": "6.11.0-28.28~24.04.1" }, { "binary_name": "linux-tools-6.11.0-28-generic-64k", "binary_version": "6.11.0-28.28~24.04.1" } ] }
{ "availability": "No subscription required", "binaries": [ { "binary_name": "linux-buildinfo-6.11.0-1015-lowlatency", "binary_version": "6.11.0-1015.16~24.04.2" }, { "binary_name": "linux-buildinfo-6.11.0-1015-lowlatency-64k", "binary_version": "6.11.0-1015.16~24.04.2" }, { "binary_name": "linux-cloud-tools-6.11.0-1015-lowlatency", "binary_version": "6.11.0-1015.16~24.04.2" }, { "binary_name": "linux-headers-6.11.0-1015-lowlatency", "binary_version": "6.11.0-1015.16~24.04.2" }, { "binary_name": "linux-headers-6.11.0-1015-lowlatency-64k", "binary_version": "6.11.0-1015.16~24.04.2" }, { "binary_name": "linux-image-unsigned-6.11.0-1015-lowlatency", "binary_version": "6.11.0-1015.16~24.04.2" }, { "binary_name": "linux-image-unsigned-6.11.0-1015-lowlatency-64k", "binary_version": "6.11.0-1015.16~24.04.2" }, { "binary_name": "linux-image-unsigned-6.11.0-1015-lowlatency-64k-dbgsym", "binary_version": "6.11.0-1015.16~24.04.2" }, { "binary_name": "linux-image-unsigned-6.11.0-1015-lowlatency-dbgsym", "binary_version": "6.11.0-1015.16~24.04.2" }, { "binary_name": "linux-lowlatency-hwe-6.11-cloud-tools-6.11.0-1015", "binary_version": "6.11.0-1015.16~24.04.2" }, { "binary_name": "linux-lowlatency-hwe-6.11-headers-6.11.0-1015", "binary_version": "6.11.0-1015.16~24.04.2" }, { "binary_name": "linux-lowlatency-hwe-6.11-lib-rust-6.11.0-1015-lowlatency", "binary_version": "6.11.0-1015.16~24.04.2" }, { "binary_name": "linux-lowlatency-hwe-6.11-tools-6.11.0-1015", "binary_version": "6.11.0-1015.16~24.04.2" }, { "binary_name": "linux-modules-6.11.0-1015-lowlatency", "binary_version": "6.11.0-1015.16~24.04.2" }, { "binary_name": "linux-modules-6.11.0-1015-lowlatency-64k", "binary_version": "6.11.0-1015.16~24.04.2" }, { "binary_name": "linux-modules-iwlwifi-6.11.0-1015-lowlatency", "binary_version": "6.11.0-1015.16~24.04.2" }, { "binary_name": "linux-tools-6.11.0-1015-lowlatency", "binary_version": "6.11.0-1015.16~24.04.2" }, { "binary_name": "linux-tools-6.11.0-1015-lowlatency-64k", "binary_version": "6.11.0-1015.16~24.04.2" } ] }
{ "availability": "No subscription required", "binaries": [ { "binary_name": "linux-buildinfo-6.11.0-1024-oem", "binary_version": "6.11.0-1024.24" }, { "binary_name": "linux-headers-6.11.0-1024-oem", "binary_version": "6.11.0-1024.24" }, { "binary_name": "linux-image-unsigned-6.11.0-1024-oem", "binary_version": "6.11.0-1024.24" }, { "binary_name": "linux-image-unsigned-6.11.0-1024-oem-dbgsym", "binary_version": "6.11.0-1024.24" }, { "binary_name": "linux-modules-6.11.0-1024-oem", "binary_version": "6.11.0-1024.24" }, { "binary_name": "linux-modules-ipu6-6.11.0-1024-oem", "binary_version": "6.11.0-1024.24" }, { "binary_name": "linux-modules-ipu7-6.11.0-1024-oem", "binary_version": "6.11.0-1024.24" }, { "binary_name": "linux-modules-iwlwifi-6.11.0-1024-oem", "binary_version": "6.11.0-1024.24" }, { "binary_name": "linux-modules-usbio-6.11.0-1024-oem", "binary_version": "6.11.0-1024.24" }, { "binary_name": "linux-modules-vision-6.11.0-1024-oem", "binary_version": "6.11.0-1024.24" }, { "binary_name": "linux-oem-6.11-headers-6.11.0-1024", "binary_version": "6.11.0-1024.24" }, { "binary_name": "linux-oem-6.11-tools-6.11.0-1024", "binary_version": "6.11.0-1024.24" }, { "binary_name": "linux-tools-6.11.0-1024-oem", "binary_version": "6.11.0-1024.24" } ] }