driver core: platform: use generic driver_override infrastructure
3Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackepss 0.1%
exploitation probability
0.1%top 97% of all CVEs
observed exploitation
nono source reports it
In the Linux kernel, the following vulnerability has been resolved:
driver core: platform: use generic driver_override infrastructure
When a driver is probed through __driver_attach(), the bus' match()
callback is called without the device lock held, thus accessing the
driver_override field without a lock, which can cause a UAF.
Fix this by using the driver-core driver_override infrastructure taking
care of proper locking internally.
Note that calling match() from __driver_attach() without the device lock
held is intentional. [1]
Affected products
Linux · LinuxReferences
https://git.kernel.org/stable/c/2b38efc05bf7a8568ec74bfffea0f5cfa62bc01dhttps://git.kernel.org/stable/c/492349e5e4a369a8b62781100a3ade470bf1ce6bhttps://git.kernel.org/stable/c/7c02a9bd7d14a89065fcf672b86d8e1d1a41d3b1https://git.kernel.org/stable/c/9a6086d2a828dd2ff74cf9abcae456670febd71fhttps://git.kernel.org/stable/c/edee7ee5a14c3b33f6d54641f5af5c5e9180992d