ieee802154: ca8210: Fix a potential UAF in ca8210_probe (Linux Linux)
At a glance
- Source
- NVD
- EPSS
- EPSS 0.24 % · percentile 16 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- Linux
- NVD status
- Analyzed
Description
In the Linux kernel, the following vulnerability has been resolved: ieee802154: ca8210: Fix a potential UAF in ca8210_probe If of_clk_add_provider() fails in ca8210_register_ext_clock(), it calls clk_unregister() to release priv->clk and returns an error. However, the caller ca8210_probe() then calls ca8210_remove(), where priv->clk is freed again in ca8210_unregister_ext_clock(). In this case, a use-after-free may happen in the second time we call clk_unregister(). Fix this by removing the first clk_unregister(). Also, priv->clk could be an error code on failure of clk_register_fixed_rate(). Use IS_ERR_OR_NULL to catch this case in ca8210_unregister_ext_clock().
Weaknesses (CWE)
- CWE-416 — Use After Free
References
- https://git.kernel.org/stable/c/28b68cba378e3e50a4082b65f262bc4f2c7c2add
- https://git.kernel.org/stable/c/cdb46be93c1f7bbf2c4649e9fc5fb147cfb5245d
- https://git.kernel.org/stable/c/85c2857ef90041f567ce98722c1c342c4d31f4bc
- https://git.kernel.org/stable/c/55e06850c7894f00d41b767c5f5665459f83f58f
- https://git.kernel.org/stable/c/84c6aa0ae5c4dc121f9996bb8fed46c80909d80e
- https://git.kernel.org/stable/c/217efe32a45249eb07dcd7197e8403de98345e66
- https://git.kernel.org/stable/c/becf5c147198f4345243c5df0c4f035415491640
- https://git.kernel.org/stable/c/f990874b1c98fe8e57ee9385669f501822979258
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | HIGH 7.8 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H | NVD · nvd@nist.gov (Primary) |
European references
- ENISA EUVD · EUVD-2023-57135
- GCVE · GCVE-0-2023-52510
CERT-FR advisories
- CERTFR-2025-AVI-0677 — Multiples vulnérabilités dans les produits Siemens · cert.ssi.gouv.fr
- CERTFR-2024-AVI-0906 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
- CERTFR-2024-AVI-0363 — Multiples vulnérabilités dans le noyau Linux de SUSE · cert.ssi.gouv.fr
- CERTFR-2024-AVI-0329 — Multiples vulnérabilités dans le noyau Linux de SUSE · cert.ssi.gouv.fr
Affected configurations (NVD CPE)
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 4.12 < 4.14.328cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 4.15 < 4.19.297cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 4.20 < 5.4.259cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 5.5 < 5.10.199cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 5.11 < 5.15.136cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 5.16 < 6.1.59cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 6.2 < 6.5.8cpe:2.3:o:linux:linux_kernel:6.6:rc1:*:*:*:*:*:*cpe:2.3:o:linux:linux_kernel:6.6:rc2:*:*:*:*:*:*cpe:2.3:o:linux:linux_kernel:6.6:rc3:*:*:*:*:*:*cpe:2.3:o:linux:linux_kernel:6.6:rc4:*:*:*:*:*:*cpe:2.3:o:linux:linux_kernel:6.6:rc5:*:*:*:*:*:*
Affected products
| Product | Versions |
|---|---|
| Linux · Linux | affected ded845a781a578dfb0b5b2c138e5a067aa3b1242 < 28b68cba378e3e50a4082b65f262bc4f2c7c2add ; affected ded845a781a578dfb0b5b2c138e5a067aa3b1242 < cdb46be93c1f7bbf2c4649e9fc5fb147cfb5245d ; affected ded845a781a578dfb0b5b2c138e5a067aa3b1242 < 85c2857ef90041f567ce98722c1c342c4d31f4bc ; affected ded845a781a578dfb0b5b2c138e5a067aa3b1242 < 55e06850c7894f00d41b767c5f5665459f83f58f ; affected ded845a781a578dfb0b5b2c138e5a067aa3b1242 < 84c6aa0ae5c4dc121f9996bb8fed46c80909d80e ; affected ded845a781a578dfb0b5b2c138e5a067aa3b1242 < 217efe32a45249eb07dcd7197e8403de98345e66 |
| Linux · Linux | affected 4.12 ; unaffected 0 < 4.12 ; unaffected 4.14.328 ≤ 4.14.* ; unaffected 4.19.297 ≤ 4.19.* ; unaffected 5.4.259 ≤ 5.4.* ; unaffected 5.10.199 ≤ 5.10.* |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |