In the Linux kernel, the following vulnerability has been resolved:
watchdog: Fix possible use-after-free in wdt_startup()
This module's remove path calls del_timer(). However, that function does not wait until the timer handler finishes. This means that the timer handler may still be running after the driver's remove function has finished, which would result in a use-after-free.
Fix by calling del_timer_sync(), which makes sure the timer handler has finished, and unable to re-schedule itself.
CVSS Details
- CVSS 3.1 Base Score: 8.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade linux | Jul 30, 2024 | May 21, 2024 |
| Suse | — | Upgrade kernel-traceUpgrade kernel-zfcpdumpUpgrade kernel-ec2-baseUpgrade kernel-docsUpgrade kernel-symsUpgrade kernel-develUpgrade kernel-ec2-develUpgrade kernel-xen-baseUpgrade kernel-macrosUpgrade kernel-64kb-develUpgrade kernel-default-extraUpgrade kernel-devel-azureUpgrade kernel-64kbUpgrade kernel-trace-baseUpgrade kernel-default-develUpgrade kernel-syms-azureUpgrade kernel-sourceUpgrade reiserfs-kmp-defaultUpgrade kernel-xen-develUpgrade kernel-ec2Upgrade kernel-defaultUpgrade kernel-preemptUpgrade kernel-xenUpgrade kernel-source-azureUpgrade kernel-azure-baseUpgrade kernel-obs-buildUpgrade kernel-trace-develUpgrade kernel-default-manUpgrade kernel-azureUpgrade kernel-azure-develUpgrade kernel-default-baseUpgrade kernel-preempt-devel | Aug 9, 2024 | May 21, 2024 |
| Ubuntu | — | Upgrade linux-azureUpgrade linux-bluefieldUpgrade linux-oracle-5.4Upgrade linux-aws-5.4Upgrade linux-awsUpgrade linux-raspi-5.4Upgrade linux-raspiUpgrade linux-ibmUpgrade linux-gcp-4.15Upgrade linux-gcp-fipsUpgrade linuxUpgrade linux-azure-fipsUpgrade linux-azure-5.4Upgrade linux-gkeopUpgrade linux-fipsUpgrade linux-hwe-5.4Upgrade linux-hweUpgrade linux-aws-fipsUpgrade linux-aws-hweUpgrade linux-azure-fde-5.15Upgrade linux-gcpUpgrade linux-gcp-5.4Upgrade linux-azure-4.15Upgrade linux-kvmUpgrade linux-oracle | Nov 19, 2024 | May 21, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub