"value":"In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: edia: dvbdev: fix a use-after-free\n\nIn dvb_register_device, *pdvbdev is set equal to dvbdev, which is freed\nin several error-handling paths. However, *pdvbdev is not set to NULL\nafter dvbdev's deallocation, causing use-after-frees in many places,\nfor example, in the following call chain:\n\nbudget_register\n |-> dvb_dmxdev_init\n |-> dvb_register_device\n |-> dvb_dmxdev_release\n |-> dvb_unregister_device\n |-> dvb_remove_device\n |-> dvb_device_put\n |-> kref_put\n\nWhen calling dvb_unregister_device, dmxdev->dvbdev (i.e. *pdvbdev in\ndvb_register_device) could point to memory that had been freed in\ndvb_register_device. Thereafter, this pointer is transferred to\nkref_put and triggering a use-after-free."
"value":"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: medios: edia: dvbdev: corregir un use-after-free En dvb_register_device, *pdvbdev se establece igual a dvbdev, que se libera en varias rutas de manejo de errores. Sin embargo, *pdvbdev no se establece en NULL despu\u00e9s de la desasignaci\u00f3n de dvbdev, lo que provoca use-after-free en muchos lugares, por ejemplo, en la siguiente cadena de llamadas: Budget_register |-> dvb_dmxdev_init |-> dvb_register_device |-> dvb_dmxdev_release |-> dvb_unregister_device | -> dvb_remove_device |-> dvb_device_put |-> kref_put Al llamar a dvb_unregister_device, dmxdev->dvbdev (es decir, *pdvbdev en dvb_register_device) podr\u00eda apuntar a la memoria que se hab\u00eda liberado en dvb_register_device. A partir de entonces, este puntero se transfiere a kref_put y se activa un use-after-free."
