In the Linux kernel, the following vulnerability has been resolved: can: mcp251x: fix deadlock in error path of mcp251x_open The mcp251x_open() function call free_irq() in its error path with the mpc_lock mutex held. But if an interrupt already occurred the interrupt handler will be waiting for the mpc_lock and free_irq() will deadlock waiting for the handler to finish. This issue is similar to the one fixed in commit 7dd9c26bd6cf ("can: mcp251x: fix deadlock if an interrupt occurs during mcp251x_open") but for the error path. To solve this issue move the call to free_irq() after the lock is released. Setting `priv->force_quit = 1` beforehand ensure that the IRQ handler will exit right away once it acquired the lock.
En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta: can: mcp251x: corregir interbloqueo en la ruta de error de mcp251x_open La función mcp251x_open() llama a free_irq() en su ruta de error con el mutex mpc_lock retenido. Pero si ya ocurrió una interrupción, el gestor de interrupciones estará esperando por el mpc_lock y free_irq() se interbloqueará esperando a que el gestor termine. Este problema es similar al resuelto en el commit 7dd9c26bd6cf ('can: mcp251x: corregir interbloqueo si ocurre una interrupción durante mcp251x_open') pero para la ruta de error. Para resolver este problema, mueva la llamada a free_irq() después de que se libere el bloqueo. Establecer `priv->force_quit = 1` de antemano asegura que el gestor IRQ saldrá de inmediato una vez que haya adquirido el bloqueo.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
| Attack Vector | LOCAL |
|---|---|
| Attack Complexity | LOW |
| Privileges Required | LOW |
| User Interaction | NONE |
| Scope | UNCHANGED |
| Confidentiality Impact | NONE |
| Integrity Impact | NONE |
| Availability Impact | HIGH |
| Source | Type | Description |
|---|---|---|
| [email protected] | Primary |
en
CWE-667
|
| Vendor | Product | Version | Update | Type |
|---|---|---|---|---|
| linux | linux_kernel | * | <built-in method update of dict object at 0x7fd308803880> | Operating System |
| linux | linux_kernel | * | <built-in method update of dict object at 0x7fd369405480> | Operating System |
| linux | linux_kernel | * | <built-in method update of dict object at 0x7fd36b3ba800> | Operating System |
| linux | linux_kernel | * | <built-in method update of dict object at 0x7fd385056b40> | Operating System |
| linux | linux_kernel | * | <built-in method update of dict object at 0x7fd3088037c0> | Operating System |
| linux | linux_kernel | * | <built-in method update of dict object at 0x7fd341be94c0> | Operating System |
| linux | linux_kernel | * | <built-in method update of dict object at 0x7fd368e8bec0> | Operating System |
| linux | linux_kernel | 2.6.34 | <built-in method update of dict object at 0x7fd2d39fe940> | Operating System |
| linux | linux_kernel | 7.0 | <built-in method update of dict object at 0x7fd34122db80> | Operating System |
| linux | linux_kernel | 7.0 | <built-in method update of dict object at 0x7fd39c44e980> | Operating System |
| linux | linux_kernel | 7.0 | <built-in method update of dict object at 0x7fd369405c00> | Operating System |
| linux | linux_kernel | 7.0 | <built-in method update of dict object at 0x7fd38672ce80> | Operating System |
| linux | linux_kernel | 7.0 | <built-in method update of dict object at 0x7fd3426030c0> | Operating System |
| linux | linux_kernel | 7.0 | <built-in method update of dict object at 0x7fd36865eec0> | Operating System |
| linux | linux_kernel | 7.0 | <built-in method update of dict object at 0x7fd348daefc0> | Operating System |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:2.6.34:-:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:* |