coresight: prevent deactivate active config while enabling the config (Linux Linux)

CVE-2025-38131
HIGH 7.8

En bref

Source
NVD
EPSS
EPSS 0.20 % · centile 10 ()
État
PUBLISHED
Publiée
Mise à jour
Attribuée par
Linux
Statut NVD
Analyzed

Description

In the Linux kernel, the following vulnerability has been resolved: coresight: prevent deactivate active config while enabling the config While enable active config via cscfg_csdev_enable_active_config(), active config could be deactivated via configfs' sysfs interface. This could make UAF issue in below scenario: CPU0 CPU1 (sysfs enable) load module cscfg_load_config_sets() activate config. // sysfs (sys_active_cnt == 1) ... cscfg_csdev_enable_active_config() lock(csdev->cscfg_csdev_lock) // here load config activate by CPU1 unlock(csdev->cscfg_csdev_lock) deactivate config // sysfs (sys_activec_cnt == 0) cscfg_unload_config_sets() unload module // access to config_desc which freed // while unloading module. cscfg_csdev_enable_config To address this, use cscfg_config_desc's active_cnt as a reference count which will be holded when - activate the config. - enable the activated config. and put the module reference when config_active_cnt == 0.

Faiblesses (CWE)

  • CWE-416 — Utilisation après libération

Références

Scores

VersionScoreVecteurÉvalué par
CVSS 3.1HIGH 7.8CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HNVD · nvd@nist.gov (Primary)

Références européennes

Avis du CERT-FR

Configurations affectées (CPE NVD)

Produits affectés

ProduitVersions
Linux · Linuxaffected f8cce2ff3c04361b8843d8489620fda8880f668b < dfe8224c9c7a43d356eb9f74b06868aa05f90223 ; affected f8cce2ff3c04361b8843d8489620fda8880f668b < b3b4efa2e623aecaebd7c9b9e4171f5c659e9724 ; affected f8cce2ff3c04361b8843d8489620fda8880f668b < 31028812724cef7bd57a51525ce58a32a6d73b22 ; affected f8cce2ff3c04361b8843d8489620fda8880f668b < ed42ee1ed05ff2f4c36938379057413a40c56680 ; affected f8cce2ff3c04361b8843d8489620fda8880f668b < 408c97c4a5e0b634dcd15bf8b8808b382e888164
Linux · Linuxaffected 5.15 ; unaffected 0 < 5.15 ; unaffected 6.1.142 ≤ 6.1.* ; unaffected 6.6.94 ≤ 6.6.* ; unaffected 6.12.34 ≤ 6.12.* ; unaffected 6.15.3 ≤ 6.15.*

Sources

SourceLicence
CVE List (CVEProject cvelistV5)CVE Program Terms of Use
EPSS (FIRST.org)FIRST — attribution requested
ENISA EUVDENISA — reproduction authorised, source acknowledged
CERT-FR (ANSSI)Licence Ouverte / Etalab 2.0
NVD (NIST) via fkie-cad/nvd-json-data-feedsPublic domain — this product uses data from the NVD API but is not endorsed or certified by the NVD