In the Linux kernel, the following vulnerability has been resolved:
media: pvrusb2: fix uaf in pvr2_context_set_notify
[Syzbot reported] BUG: KASAN: slab-use-after-free in pvr2_context_set_notify+0x2c4/0x310 drivers/media/usb/pvrusb2/pvrusb2-context.c:35 Read of size 4 at addr ffff888113aeb0d8 by task kworker/1:1/26
CPU: 1 PID: 26 Comm: kworker/1:1 Not tainted 6.8.0-rc1-syzkaller-00046-gf1a27f081c1f #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/25/2024 Workqueue: usb_hub_wq hub_event Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0xd9/0x1b0 lib/dump_stack.c:106 print_address_description mm/kasan/report.c:377 [inline] print_report+0xc4/0x620 mm/kasan/report.c:488 kasan_report+0xda/0x110 mm/kasan/report.c:601 pvr2_context_set_notify+0x2c4/0x310 drivers/media/usb/pvrusb2/pvrusb2-context.c:35 pvr2_context_notify drivers/media/usb/pvrusb2/pvrusb2-context.c:95 [inline] pvr2_context_disconnect+0x94/0xb0 drivers/media/usb/pvrusb2/pvrusb2-context.c:272
Freed by task 906: kasan_save_stack+0x33/0x50 mm/kasan/common.c:47 kasan_save_track+0x14/0x30 mm/kasan/common.c:68 kasan_save_free_info+0x3f/0x60 mm/kasan/generic.c:640 poison_slab_object mm/kasan/common.c:241 [inline] __kasan_slab_free+0x106/0x1b0 mm/kasan/common.c:257 kasan_slab_free include/linux/kasan.h:184 [inline] slab_free_hook mm/slub.c:2121 [inline] slab_free mm/slub.c:4299 [inline] kfree+0x105/0x340 mm/slub.c:4409 pvr2_context_check drivers/media/usb/pvrusb2/pvrusb2-context.c:137 [inline] pvr2_context_thread_func+0x69d/0x960 drivers/media/usb/pvrusb2/pvrusb2-context.c:158
[Analyze] Task A set disconnect_flag = !0, which resulted in Task B's condition being met and releasing mp, leading to this issue.
[Fix] Place the disconnect_flag assignment operation after all code in pvr2_context_disconnect() to avoid this issue.
CVSS Details
- CVSS 3.1 Base Score: 6.4
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade linux | May 8, 2024 | Apr 17, 2024 |
| Huawei Euleros 2_0_sp10 | — | Upgrade kernel-tools-libsUpgrade kernel-toolsUpgrade python3-perfUpgrade kernelUpgrade kernel-abi-stablelists | Jul 16, 2024 | Apr 17, 2024 |
| Huawei Euleros 2_0_sp11 | — | Upgrade bpftoolUpgrade kernel-tools-libsUpgrade kernel-toolsUpgrade kernel-abi-stablelistsUpgrade kernelUpgrade python3-perf | Jun 26, 2024 | Apr 17, 2024 |
| Huawei Euleros 2_0_sp12 | — | Upgrade bpftoolUpgrade kernel-toolsUpgrade kernel-tools-libsUpgrade kernel-abi-stablelistsUpgrade kernelUpgrade python3-perf | Oct 8, 2024 | Apr 17, 2024 |
| Huawei Euleros 2_0_sp9 | — | Upgrade kernel-toolsUpgrade python3-perfUpgrade kernel-tools-libsUpgrade kernel | Jul 17, 2024 | Apr 17, 2024 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Apr 17, 2024 |
| Suse | — | Upgrade kernel-debug-livepatch-develUpgrade cluster-md-kmp-defaultUpgrade dlm-kmp-defaultUpgrade kselftests-kmp-defaultUpgrade kernel-macrosUpgrade kernel-default-livepatch-develUpgrade kernel-docsUpgrade reiserfs-kmp-azureUpgrade kernel-devel-rtUpgrade ocfs2-kmp-rtUpgrade dtb-apmUpgrade kernel-rt-livepatch-develUpgrade kernel-syms-rtUpgrade kselftests-kmp-rtUpgrade kernel-obs-qaUpgrade dtb-armUpgrade dtb-sprdUpgrade kernel-default-baseUpgrade dtb-appleUpgrade reiserfs-kmp-rtUpgrade dtb-socionextUpgrade kernel-default-manUpgrade cluster-md-kmp-64kbUpgrade kernel-default-extraUpgrade kernel-azure-vdsoUpgrade kernel-rt_debug-livepatch-develUpgrade reiserfs-kmp-defaultUpgrade kernel-rt_debug-vdsoUpgrade dlm-kmp-rtUpgrade kernel-debugUpgrade dtb-nvidiaUpgrade dtb-hisiliconUpgrade kernel-rt_debugUpgrade dtb-marvellUpgrade dtb-amdUpgrade kernel-kvmsmall-vdsoUpgrade kernel-64kb-extraUpgrade dtb-amlogicUpgrade dtb-renesasUpgrade dtb-mediatekUpgrade dlm-kmp-azureUpgrade dtb-rockchipUpgrade kernel-symsUpgrade kernel-64kb-develUpgrade kernel-defaultUpgrade kernel-debug-develUpgrade kernel-rt-optionalUpgrade cluster-md-kmp-azureUpgrade kernel-64kbUpgrade ocfs2-kmp-defaultUpgrade kernel-azure-optionalUpgrade dlm-kmp-64kbUpgrade kernel-azure-livepatch-develUpgrade dtb-freescaleUpgrade dtb-alteraUpgrade kernel-rtUpgrade kernel-kvmsmall-develUpgrade kernel-default-optionalUpgrade kernel-64kb-livepatch-develUpgrade kernel-devel-azureUpgrade dtb-lgUpgrade ocfs2-kmp-azureUpgrade ocfs2-kmp-64kbUpgrade kernel-source-vanillaUpgrade kernel-source-azureUpgrade kernel-default-livepatchUpgrade kernel-azure-develUpgrade gfs2-kmp-rtUpgrade kernel-debug-vdsoUpgrade kernel-source-rtUpgrade kernel-rt-vdsoUpgrade kernel-default-vdsoUpgrade dtb-exynosUpgrade cluster-md-kmp-rtUpgrade kernel-rt_debug-develUpgrade dtb-xilinxUpgrade kernel-kvmsmall-livepatch-develUpgrade kernel-azure-extraUpgrade gfs2-kmp-defaultUpgrade kernel-docs-htmlUpgrade dtb-qcomUpgrade kernel-default-develUpgrade dtb-broadcomUpgrade kernel-syms-azureUpgrade kernel-kvmsmallUpgrade kernel-default-base-rebuildUpgrade kernel-azureUpgrade gfs2-kmp-64kbUpgrade reiserfs-kmp-64kbUpgrade kselftests-kmp-azureUpgrade kselftests-kmp-64kbUpgrade kernel-sourceUpgrade kernel-rt-extraUpgrade dtb-allwinnerUpgrade kernel-zfcpdumpUpgrade gfs2-kmp-azureUpgrade dtb-caviumUpgrade dtb-amazonUpgrade kernel-rt-livepatchUpgrade kernel-develUpgrade kernel-64kb-optionalUpgrade kernel-rt-develUpgrade kernel-obs-build | May 15, 2024 | Apr 17, 2024 |
| Ubuntu | — | Upgrade linux-image-5.15.0-1058-intel-iotgUpgrade linux-image-virtualUpgrade linux-image-lowlatency-hwe-18.04Upgrade linux-image-gkeop-5.15Upgrade linux-image-6.8.0-35-lowlatency-64kUpgrade linux-image-intel-iotgUpgrade linux-image-6.8.0-1004-gkeUpgrade linux-image-gcp-lts-20.04Upgrade linux-image-oracle-64kUpgrade linux-image-oracle-lts-20.04Upgrade linux-image-virtual-hwe-18.04Upgrade linux-image-5.4.0-1088-bluefieldUpgrade linux-image-5.15.0-1060-gkeUpgrade linux-image-5.15.0-1046-gkeopUpgrade linux-image-oem-osp1Upgrade linux-image-6.8.0-1008-azure-fdeUpgrade linux-image-5.15.0-110-lowlatency-64kUpgrade linux-image-5.4.0-1128-awsUpgrade linux-image-oracle-lts-22.04Upgrade linux-image-5.4.0-1133-azureUpgrade linux-image-gkeUpgrade linux-image-virtual-hwe-20.04Upgrade linux-image-oemUpgrade linux-image-5.4.0-1127-oracleUpgrade linux-image-oracleUpgrade linux-image-6.8.0-35-genericUpgrade linux-image-6.8.0-1009-awsUpgrade linux-image-5.15.0-1065-azure-fdeUpgrade linux-image-xilinx-zynqmpUpgrade linux-image-5.15.0-1057-ibmUpgrade linux-image-raspi-hwe-18.04Upgrade linux-image-5.15.0-112-generic-64kUpgrade linux-image-5.15.0-113-generic-lpaeUpgrade linux-image-6.8.0-1006-oracle-64kUpgrade linux-image-raspi-nolpaeUpgrade linux-image-oem-20.04Upgrade linux-image-5.4.0-1112-raspiUpgrade linux-image-kvmUpgrade linux-image-generic-hwe-24.04Upgrade linux-image-awsUpgrade linux-image-5.4.0-1040-iotUpgrade linux-image-oem-24.04Upgrade linux-image-virtual-hwe-24.04Upgrade linux-image-generic-lpae-hwe-20.04Upgrade linux-image-generic-hwe-20.04Upgrade linux-image-6.8.0-1008-gcpUpgrade linux-image-bluefieldUpgrade linux-image-6.8.0-1006-oemUpgrade linux-image-5.15.0-1066-azureUpgrade linux-image-6.8.0-35-lowlatencyUpgrade linux-image-5.4.0-1075-ibmUpgrade linux-image-generic-64k-hwe-24.04Upgrade linux-image-5.4.0-1095-gkeopUpgrade linux-image-5.15.0-1058-raspiUpgrade linux-image-5.15.0-1056-ibmUpgrade linux-image-5.15.0-1060-kvmUpgrade linux-image-5.4.0-189-generic-lpaeUpgrade linux-image-azure-fdeUpgrade linux-image-gkeop-5.4Upgrade linux-image-5.15.0-1062-gcpUpgrade linux-image-5.15.0-1063-awsUpgrade linux-image-5.15.0-110-lowlatencyUpgrade linux-image-azure-fde-lts-22.04Upgrade linux-image-azureUpgrade linux-image-generic-hwe-18.04Upgrade linux-image-oem-20.04bUpgrade linux-image-generic-lpaeUpgrade linux-image-snapdragon-hwe-18.04Upgrade linux-image-gcp-lts-22.04Upgrade linux-image-azure-lts-22.04Upgrade linux-image-5.15.0-1061-oracleUpgrade linux-image-raspi2Upgrade linux-image-lowlatency-64k-hwe-20.04Upgrade linux-image-generic-64kUpgrade linux-image-nvidia-lowlatencyUpgrade linux-image-ibmUpgrade linux-image-5.15.0-113-genericUpgrade linux-image-azure-lts-20.04Upgrade linux-image-5.15.0-1058-nvidia-lowlatencyUpgrade linux-image-intelUpgrade linux-image-gkeopUpgrade linux-image-6.8.0-1008-azureUpgrade linux-image-5.15.0-1030-xilinx-zynqmpUpgrade linux-image-ibm-lts-20.04Upgrade linux-image-5.15.0-112-genericUpgrade linux-image-6.8.0-35-generic-64kUpgrade linux-image-5.4.0-1047-xilinx-zynqmpUpgrade linux-image-lowlatencyUpgrade linux-image-5.15.0-112-generic-lpaeUpgrade linux-image-oem-20.04dUpgrade linux-image-lowlatency-64kUpgrade linux-image-gcpUpgrade linux-image-5.4.0-189-genericUpgrade linux-image-gke-5.15Upgrade linux-image-raspiUpgrade linux-image-generic-64k-hwe-20.04Upgrade linux-image-ibm-classicUpgrade linux-image-5.15.0-113-generic-64kUpgrade linux-image-6.8.0-1006-ibmUpgrade linux-image-5.4.0-1132-gcpUpgrade linux-image-oem-20.04cUpgrade linux-image-aws-lts-20.04Upgrade linux-image-6.8.0-1005-raspiUpgrade linux-image-6.8.0-1006-oracleUpgrade linux-image-ibm-lts-24.04Upgrade linux-image-genericUpgrade linux-image-aws-lts-22.04Upgrade linux-image-lowlatency-hwe-20.04Upgrade linux-image-nvidiaUpgrade linux-image-5.4.0-1116-kvmUpgrade linux-image-5.15.0-1058-nvidiaUpgrade linux-image-oem-24.04aUpgrade linux-image-5.4.0-189-lowlatency | Jul 1, 2024 | Apr 17, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Apr 17, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub