mirror of
https://github.com/fkie-cad/nvd-json-data-feeds.git
synced 2025-05-28 09:11:28 +00:00
37 lines
3.6 KiB
JSON
37 lines
3.6 KiB
JSON
{
|
|
"id": "CVE-2025-21810",
|
|
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
|
"published": "2025-02-27T20:16:03.587",
|
|
"lastModified": "2025-02-27T20:16:03.587",
|
|
"vulnStatus": "Awaiting Analysis",
|
|
"cveTags": [],
|
|
"descriptions": [
|
|
{
|
|
"lang": "en",
|
|
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndriver core: class: Fix wild pointer dereferences in API class_dev_iter_next()\n\nThere are a potential wild pointer dereferences issue regarding APIs\nclass_dev_iter_(init|next|exit)(), as explained by below typical usage:\n\n// All members of @iter are wild pointers.\nstruct class_dev_iter iter;\n\n// class_dev_iter_init(@iter, @class, ...) checks parameter @class for\n// potential class_to_subsys() error, and it returns void type and does\n// not initialize its output parameter @iter, so caller can not detect\n// the error and continues to invoke class_dev_iter_next(@iter) even if\n// @iter still contains wild pointers.\nclass_dev_iter_init(&iter, ...);\n\n// Dereference these wild pointers in @iter here once suffer the error.\nwhile (dev = class_dev_iter_next(&iter)) { ... };\n\n// Also dereference these wild pointers here.\nclass_dev_iter_exit(&iter);\n\nActually, all callers of these APIs have such usage pattern in kernel tree.\nFix by:\n- Initialize output parameter @iter by memset() in class_dev_iter_init()\n and give callers prompt by pr_crit() for the error.\n- Check if @iter is valid in class_dev_iter_next()."
|
|
},
|
|
{
|
|
"lang": "es",
|
|
"value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: n\u00facleo del controlador: clase: Arreglar desreferencias de punteros salvajes en la API class_dev_iter_next() Hay un posible problema de desreferencias de punteros salvajes con respecto a las API class_dev_iter_(init|next|exit()), como se explica a continuaci\u00f3n en el uso t\u00edpico: // Todos los miembros de @iter son punteros salvajes. struct class_dev_iter iter; // class_dev_iter_init(@iter, @class, ...) comprueba el par\u00e1metro @class en busca de un posible error class_to_subsys(), y devuelve el tipo void y no inicializa su par\u00e1metro de salida @iter, por lo que el llamador no puede detectar el error y contin\u00faa invocando class_dev_iter_next(@iter) incluso si @iter todav\u00eda contiene punteros salvajes. class_dev_iter_init(&iter, ...); // Desreferencia estos punteros salvajes en @iter aqu\u00ed una vez que sufre el error. mientras (dev = class_dev_iter_next(&iter)) { ... }; // Tambi\u00e9n desreferencia estos punteros salvajes aqu\u00ed. class_dev_iter_exit(&iter); En realidad, todos los que llaman a estas API tienen ese patr\u00f3n de uso en el \u00e1rbol del kernel. Solucione esto: - Inicialice el par\u00e1metro de salida @iter con memset() en class_dev_iter_init() y d\u00e9 a los que llaman un aviso con pr_crit() para el error. - Verifique si @iter es v\u00e1lido en class_dev_iter_next()."
|
|
}
|
|
],
|
|
"metrics": {},
|
|
"references": [
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/1614e75d1a1b63db6421c7a4bf37004720c7376c",
|
|
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/5c504e9767b947cf7d4e29b811c0c8b3c53242b7",
|
|
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/e128f82f7006991c99a58114f70ef61e937b1ac1",
|
|
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/f4b9bc823b0cfdebfed479c0e87d6939c7562e87",
|
|
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
|
|
}
|
|
]
|
|
} |