Bug 1224919 (CVE-2021-47278)

Summary: VUL-0: CVE-2021-47278: kernel: bus: mhi: pci_generic: Fix possible use-after-free in mhi_pci_remove()
Product: [Novell Products] SUSE Security Incidents Reporter: SMASH SMASH <smash_bz>
Component: IncidentsAssignee: Security Team bot <security-team>
Status: RESOLVED INVALID QA Contact: Security Team bot <security-team>
Severity: Normal    
Priority: P3 - Medium CC: carlos.lopez, mhocko
Version: unspecified   
Target Milestone: ---   
Hardware: Other   
OS: Other   
URL: https://smash.suse.de/issue/406909/
Whiteboard: CVSSv3.1:SUSE:CVE-2021-47278:6.4:(AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H)
Found By: Security Response Team Services Priority:
Business Priority: Blocker: ---
Marketing QA Status: --- IT Deployment: ---

Description SMASH SMASH 2024-05-22 11:18:14 UTC 
In the Linux kernel, the following vulnerability has been resolved:

bus: mhi: pci_generic: Fix possible use-after-free in mhi_pci_remove()

This driver's remove path calls del_timer(). However, that function
does not wait until the timer handler finishes. This means that the
timer handler may still be running after the driver's remove function
has finished, which would result in a use-after-free.

Fix by calling del_timer_sync(), which makes sure the timer handler
has finished, and unable to re-schedule itself.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-47278
https://www.cve.org/CVERecord?id=CVE-2021-47278
https://git.kernel.org/stable/c/0b67808ade8893a1b3608ddd74fac7854786c919
https://git.kernel.org/stable/c/c597d5c59c7a6417dba06590f59b922e01188e8d
https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2021/CVE-2021-47278.mbox
Comment 2 Michal Hocko 2024-05-24 12:48:25 UTC 
nothing to be done
Comment 3 Carlos López 2024-05-28 11:23:54 UTC 
Nothing to do, closing.