CVE-2019-25162

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2019-25162
In the Linux kernel, the following vulnerability has been resolved: i2c: Fix a potential use after free Free the adap structure only after we are done using it. This patch just moves the put_device() down a bit to avoid the use after free. [wsa: added comment to the code, added Fixes tag]

7.8 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/12b0606000d0828630c033bf0c74c748464fe87d Patch
https://git.kernel.org/stable/c/23a191b132cd87f746c62f3dc27da33683d85829 Patch
https://git.kernel.org/stable/c/35927d7509ab9bf41896b7e44f639504eae08af7 Patch
https://git.kernel.org/stable/c/81cb31756888bb062e92d2dca21cd629d77a46a9 Patch
https://git.kernel.org/stable/c/871a1e94929a27bf6e2cd99523865c840bbc2d87 Patch
https://git.kernel.org/stable/c/e4c72c06c367758a14f227c847f9d623f1994ecf Patch
https://git.kernel.org/stable/c/e6412ba3b6508bdf9c074d310bf4144afa6aec1a Patch
https://git.kernel.org/stable/c/e8e1a046cf87c8b1363e5de835114f2779e2aaf4 Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
History

17 Apr 2024, 17:38

Type Values Removed Values Added
Summary
  • (es) En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: i2c: corrige un use after free que libera la estructura adap solo después de que hayamos terminado de usarla. Este parche simplemente mueve put_device() un poco hacia abajo para evitar el use after free. [wsa: comentario agregado al código, etiqueta de correcciones agregada]
References () https://git.kernel.org/stable/c/12b0606000d0828630c033bf0c74c748464fe87d - () https://git.kernel.org/stable/c/12b0606000d0828630c033bf0c74c748464fe87d - Patch
References () https://git.kernel.org/stable/c/23a191b132cd87f746c62f3dc27da33683d85829 - () https://git.kernel.org/stable/c/23a191b132cd87f746c62f3dc27da33683d85829 - Patch
References () https://git.kernel.org/stable/c/35927d7509ab9bf41896b7e44f639504eae08af7 - () https://git.kernel.org/stable/c/35927d7509ab9bf41896b7e44f639504eae08af7 - Patch
References () https://git.kernel.org/stable/c/81cb31756888bb062e92d2dca21cd629d77a46a9 - () https://git.kernel.org/stable/c/81cb31756888bb062e92d2dca21cd629d77a46a9 - Patch
References () https://git.kernel.org/stable/c/871a1e94929a27bf6e2cd99523865c840bbc2d87 - () https://git.kernel.org/stable/c/871a1e94929a27bf6e2cd99523865c840bbc2d87 - Patch
References () https://git.kernel.org/stable/c/e4c72c06c367758a14f227c847f9d623f1994ecf - () https://git.kernel.org/stable/c/e4c72c06c367758a14f227c847f9d623f1994ecf - Patch
References () https://git.kernel.org/stable/c/e6412ba3b6508bdf9c074d310bf4144afa6aec1a - () https://git.kernel.org/stable/c/e6412ba3b6508bdf9c074d310bf4144afa6aec1a - Patch
References () https://git.kernel.org/stable/c/e8e1a046cf87c8b1363e5de835114f2779e2aaf4 - () https://git.kernel.org/stable/c/e8e1a046cf87c8b1363e5de835114f2779e2aaf4 - Patch
First Time Linux linux Kernel
Linux
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 7.8
CPE cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
CWE CWE-416

26 Feb 2024, 18:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-02-26 18:15

Updated : 2024-04-17 17:38

NVD link : CVE-2019-25162

Mitre link : CVE-2019-25162

CVE.ORG link : CVE-2019-25162

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
CWE-416

Use After Free