"value":"In the Linux kernel, the following vulnerability has been resolved:\n\ngreybus: Fix use-after-free bug in gb_interface_release due to race condition.\n\nIn gb_interface_create, &intf->mode_switch_completion is bound with\ngb_interface_mode_switch_work. Then it will be started by\ngb_interface_request_mode_switch. Here is the relevant code.\nif (!queue_work(system_long_wq, &intf->mode_switch_work)) {\n\t...\n}\n\nIf we call gb_interface_release to make cleanup, there may be an\nunfinished work. This function will call kfree to free the object\n\"intf\". However, if gb_interface_mode_switch_work is scheduled to\nrun after kfree, it may cause use-after-free error as\ngb_interface_mode_switch_work will use the object \"intf\".\nThe possible execution flow that may lead to the issue is as follows:\n\nCPU0 CPU1\n\n | gb_interface_create\n | gb_interface_request_mode_switch\ngb_interface_release |\nkfree(intf) (free) |\n | gb_interface_mode_switch_work\n | mutex_lock(&intf->mutex) (use)\n\nFix it by canceling the work before kfree."
"value":"En el kernel de Linux, se resolvi\u00f3 la siguiente vulnerabilidad: greybus: corrigi\u00f3 el error de use-after-free en gb_interface_release debido a la condici\u00f3n de ejecuci\u00f3n. En gb_interface_create, &intf->mode_switch_completion est\u00e1 vinculado con gb_interface_mode_switch_work. Luego lo iniciar\u00e1 gb_interface_request_mode_switch. Aqu\u00ed est\u00e1 el c\u00f3digo relevante. if (!queue_work(system_long_wq, &intf->mode_switch_work)) { ... } Si llamamos a gb_interface_release para realizar la limpieza, es posible que haya un trabajo sin terminar. Esta funci\u00f3n llamar\u00e1 a kfree para liberar el objeto \"intf\". Sin embargo, si gb_interface_mode_switch_work est\u00e1 programado para ejecutarse despu\u00e9s de kfree, puede causar un error de use-after-free ya que gb_interface_mode_switch_work usar\u00e1 el objeto \"intf\". El posible flujo de ejecuci\u00f3n que puede provocar el problema es el siguiente: CPU0 CPU1 | gb_interface_create | gb_interface_request_mode_switch gb_interface_release | kfree(intf) (gratis) | | gb_interface_mode_switch_work | mutex_lock(&intf->mutex) (uso) Solucionarlo cancelando el trabajo antes de kfree."
