In the Linux kernel, the following vulnerability has been resolved:
isdn: mISDN: netjet: Fix crash in nj_probe:
'nj_setup' in netjet.c might fail with -EIO and in this case 'card->irq' is initialized and is bigger than zero. A subsequent call to 'nj_release' will free the irq that has not been requested.
Fix this bug by deleting the previous assignment to 'card->irq' and just keep the assignment before 'request_irq'.
The KASAN's log reveals it:
[ 3.354615 ] WARNING: CPU: 0 PID: 1 at kernel/irq/manage.c:1826 free_irq+0x100/0x480 [ 3.355112 ] Modules linked in: [ 3.355310 ] CPU: 0 PID: 1 Comm: swapper/0 Not tainted 5.13.0-rc1-00144-g25a1298726e #13 [ 3.355816 ] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.12.0-59-gc9ba5276e321-prebuilt.qemu.org 04/01/2014 [ 3.356552 ] RIP: 0010:free_irq+0x100/0x480 [ 3.356820 ] Code: 6e 08 74 6f 4d 89 f4 e8 5e ac 09 00 4d 8b 74 24 18 4d 85 f6 75 e3 e8 4f ac 09 00 8b 75 c8 48 c7 c7 78 c1 2e 85 e8 e0 cf f5 ff <0f> 0b 48 8b 75 c0 4c 89 ff e8 72 33 0b 03 48 8b 43 40 4c 8b a0 80 [ 3.358012 ] RSP: 0000:ffffc90000017b48 EFLAGS: 00010082 [ 3.358357 ] RAX: 0000000000000000 RBX: ffff888104dc8000 RCX: 0000000000000000 [ 3.358814 ] RDX: ffff8881003c8000 RSI: ffffffff8124a9e6 RDI: 00000000ffffffff [ 3.359272 ] RBP: ffffc90000017b88 R08: 0000000000000000 R09: 0000000000000000 [ 3.359732 ] R10: ffffc900000179f0 R11: 0000000000001d04 R12: 0000000000000000 [ 3.360195 ] R13: ffff888107dc6000 R14: ffff888107dc6928 R15: ffff888104dc80a8 [ 3.360652 ] FS: 0000000000000000(0000) GS:ffff88817bc00000(0000) knlGS:0000000000000000 [ 3.361170 ] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 3.361538 ] CR2: 0000000000000000 CR3: 000000000582e000 CR4: 00000000000006f0 [ 3.362003 ] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 3.362175 ] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 3.362175 ] Call Trace: [ 3.362175 ] nj_release+0x51/0x1e0 [ 3.362175 ] nj_probe+0x450/0x950 [ 3.362175 ] ? pci_device_remove+0x110/0x110 [ 3.362175 ] local_pci_probe+0x45/0xa0 [ 3.362175 ] pci_device_probe+0x12b/0x1d0 [ 3.362175 ] really_probe+0x2a9/0x610 [ 3.362175 ] driver_probe_device+0x90/0x1d0 [ 3.362175 ] ? mutex_lock_nested+0x1b/0x20 [ 3.362175 ] device_driver_attach+0x68/0x70 [ 3.362175 ] __driver_attach+0x124/0x1b0 [ 3.362175 ] ? device_driver_attach+0x70/0x70 [ 3.362175 ] bus_for_each_dev+0xbb/0x110 [ 3.362175 ] ? rdinit_setup+0x45/0x45 [ 3.362175 ] driver_attach+0x27/0x30 [ 3.362175 ] bus_add_driver+0x1eb/0x2a0 [ 3.362175 ] driver_register+0xa9/0x180 [ 3.362175 ] __pci_register_driver+0x82/0x90 [ 3.362175 ] ? w6692_init+0x38/0x38 [ 3.362175 ] nj_init+0x36/0x38 [ 3.362175 ] do_one_initcall+0x7f/0x3d0 [ 3.362175 ] ? rdinit_setup+0x45/0x45 [ 3.362175 ] ? rcu_read_lock_sched_held+0x4f/0x80 [ 3.362175 ] kernel_init_freeable+0x2aa/0x301 [ 3.362175 ] ? rest_init+0x2c0/0x2c0 [ 3.362175 ] kernel_init+0x18/0x190 [ 3.362175 ] ? rest_init+0x2c0/0x2c0 [ 3.362175 ] ? rest_init+0x2c0/0x2c0 [ 3.362175 ] ret_from_fork+0x1f/0x30 [ 3.362175 ] Kernel panic - not syncing: panic_on_warn set ... [ 3.362175 ] CPU: 0 PID: 1 Comm: swapper/0 Not tainted 5.13.0-rc1-00144-g25a1298726e #13 [ 3.362175 ] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.12.0-59-gc9ba5276e321-prebuilt.qemu.org 04/01/2014 [ 3.362175 ] Call Trace: [ 3.362175 ] dump_stack+0xba/0xf5 [ 3.362175 ] ? free_irq+0x100/0x480 [ 3.362175 ] panic+0x15a/0x3f2 [ 3.362175 ] ? __warn+0xf2/0x150 [ 3.362175 ] ? free_irq+0x100/0x480 [ 3.362175 ] __warn+0x108/0x150 [ 3.362175 ] ? free_irq+0x100/0x480 [ 3.362175 ] report_bug+0x119/0x1c0 [ 3.362175 ] handle_bug+0x3b/0x80 [ 3.362175 ] exc_invalid_op+0x18/0x70 [ 3.362175 ] asm_exc_invalid_op+0x12/0x20 [ 3.362175 ] RIP: 0010:free_irq+0x100 ---truncated---
CVSS Details
- CVSS 3.1 Base Score: 4.7
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade kernel-modules-extraUpgrade kernel-debug-modulesUpgrade kernel-rt-modulesUpgrade kernel-zfcpdumpUpgrade kernel-docUpgrade kernel-toolsUpgrade kernel-rt-debug-modules-extraUpgrade bpftoolUpgrade kernel-tools-libsUpgrade kernel-zfcpdump-modulesUpgrade kernel-rt-debug-modulesUpgrade kernel-zfcpdump-coreUpgrade kernel-abi-stablelistsUpgrade kernel-debug-modules-extraUpgrade kernel-modulesUpgrade kernel-tools-libs-develUpgrade kernel-rt-kvmUpgrade kernel-rtUpgrade kernel-coreUpgrade kernel-headersUpgrade kernel-develUpgrade kernel-debug-coreUpgrade kernel-rt-coreUpgrade kernel-rt-modules-extraUpgrade kernel-rt-debugUpgrade kernel-cross-headersUpgrade kernel-rt-debug-develUpgrade kernel-rt-develUpgrade kernel-zfcpdump-modules-extraUpgrade kernel-debug-develUpgrade kernelUpgrade kernel-rt-debug-kvmUpgrade kernel-debugUpgrade kernel-rt-debug-coreUpgrade perfUpgrade kernel-zfcpdump-develUpgrade python3-perf | Aug 12, 2024 | May 21, 2024 |
| Debian | — | Upgrade linux | Jul 30, 2024 | May 21, 2024 |
| Huawei Euleros 2_0_sp10 | — | Upgrade kernelUpgrade kernel-abi-stablelistsUpgrade kernel-toolsUpgrade kernel-tools-libsUpgrade python3-perf | Oct 8, 2024 | May 21, 2024 |
| Huawei Euleros 2_0_sp9 | — | Upgrade kernelUpgrade kernel-tools-libsUpgrade kernel-toolsUpgrade python3-perf | Oct 8, 2024 | May 21, 2024 |
| Oracle_linux | — | Upgrade kernelUpgrade kernel-uek | Aug 16, 2024 | May 21, 2024 |
| Redhat_linux | — | Upgrade kernel-rtNo solution existsUpgrade kernel | Aug 12, 2024 | May 21, 2024 |
| Rocky_linux | — | Upgrade kernel-debuginfoUpgrade kernel-cross-headersUpgrade kernel-debug-modulesUpgrade kernel-rt-debug-develUpgrade kernel-tools-libsUpgrade kernel-debugUpgrade kernel-modules-extraUpgrade kernel-rt-debug-coreUpgrade kernel-rt-debuginfo-common-x86_64Upgrade kernelUpgrade kernel-tools-debuginfoUpgrade kernel-rt-debug-debuginfoUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-rt-coreUpgrade python3-perfUpgrade kernel-rt-debug-kvmUpgrade kernel-debug-coreUpgrade kernel-debug-develUpgrade kernel-rt-modules-extraUpgrade kernel-headersUpgrade python3-perf-debuginfoUpgrade kernel-rt-modulesUpgrade kernel-debug-debuginfoUpgrade kernel-coreUpgrade kernel-modulesUpgrade perfUpgrade kernel-debug-modules-extraUpgrade bpftoolUpgrade kernel-rt-debug-modulesUpgrade kernel-develUpgrade perf-debuginfoUpgrade kernel-rt-debug-modules-extraUpgrade kernel-rt-develUpgrade kernel-rt-debuginfoUpgrade kernel-rt-debugUpgrade bpftool-debuginfoUpgrade kernel-tools-libs-develUpgrade kernel-rt-kvmUpgrade kernel-toolsUpgrade kernel-rt | Aug 22, 2024 | May 21, 2024 |
| Suse | — | Upgrade kernel-default-manUpgrade kernel-syms-azureUpgrade kernel-azure-baseUpgrade kernel-defaultUpgrade kernel-preempt-develUpgrade kernel-preemptUpgrade kernel-azure-develUpgrade kernel-default-baseUpgrade kernel-azureUpgrade kernel-obs-buildUpgrade kernel-default-extraUpgrade kernel-default-develUpgrade kernel-64kb-develUpgrade kernel-devel-azureUpgrade kernel-64kbUpgrade kernel-macrosUpgrade reiserfs-kmp-defaultUpgrade kernel-zfcpdumpUpgrade kernel-symsUpgrade kernel-sourceUpgrade kernel-develUpgrade kernel-source-azureUpgrade kernel-docs | Aug 9, 2024 | May 21, 2024 |
| Ubuntu | — | Upgrade linuxUpgrade linux-gkeopUpgrade linux-oracleUpgrade linux-aws-fipsUpgrade linux-azure-5.4Upgrade linux-gcp-fipsUpgrade linux-gcpUpgrade linux-hweUpgrade linux-kvmUpgrade linux-gcp-4.15Upgrade linux-hwe-5.4Upgrade linux-azure-fipsUpgrade linux-azure-fde-5.15Upgrade linux-azure-4.15Upgrade linux-gcp-5.4Upgrade linux-bluefieldUpgrade linux-aws-5.4Upgrade linux-aws-hweUpgrade linux-oracle-5.4Upgrade linux-azureUpgrade linux-fipsUpgrade linux-awsUpgrade linux-raspiUpgrade linux-raspi-5.4 | Nov 19, 2024 | May 21, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub