NetSight
IP …
medium5.5

CVE-2024-39493

In the Linux kernel, the following vulnerability has been resolved: crypto: qat - Fix ADF_DEV_RESET_SYNC memory leak Using completion_done to determine whether…

Impact

In the Linux kernel, the following vulnerability has been resolved: crypto: qat - Fix ADF_DEV_RESET_SYNC memory leak Using completion_done to determine whether the caller has gone away only works after a complete call. Furthermore it's still possible that the caller has not yet called wait_for_completion, resulting in another potential UAF. Fix this by making the caller use cancel_work_sync and then freeing the memory safely.

Affected products

VendorProductAffected versions
LinuxLinux Kernel
from 4.19.312 before 4.19.316
from 5.4.274 before 5.4.278
from 5.10.215 before 5.10.219
from 5.15.154 before 5.15.161
from 6.1.84 before 6.1.94
from 6.6.24 before 6.6.34

Weakness classification

CWE-401

References