title: net: nfc: fix races in nfc_llcp_sock_get() and nfc_llcp_sock_get_sn()
description: In the Linux kernel, the following vulnerability has been resolved:
net: nfc: fix races in nfc_llcp_sock_get() and nfc_llcp_sock_get_sn()
Sili Luo reported a race in nfc_llcp_sock_get(), leading to UAF.
Getting a reference on the socket found in a lookup while
holding a lock should happen before releasing the lock.
nfc_llcp_sock_get_sn() has a similar problem.
Finally nfc_llcp_recv_snl() needs to make sure the socket
found by nfc_llcp_sock_from_sn() does not disappear.
affected:
{
product: Linux
vendor: Linux
defaultStatus: unaffected
repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
versions:
version: 8f50020ed9b8, lessThan: e863f5720a56, status: affected, versionType: git
version: 8f50020ed9b8, lessThan: 7adcf014bda1, status: affected, versionType: git
version: 8f50020ed9b8, lessThan: 6ac22ecdaad2, status: affected, versionType: git
version: 8f50020ed9b8, lessThan: d888d3f70b0d, status: affected, versionType: git
version: 8f50020ed9b8, lessThan: e4f2611f07c8, status: affected, versionType: git
version: 8f50020ed9b8, lessThan: d1af8a39cf83, status: affected, versionType: git
version: 8f50020ed9b8, lessThan: 31c07dffafce, status: affected, versionType: git
}
{
product: Linux
vendor: Linux
defaultStatus: affected
repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
versions:
version: 3.6, status: affected
version: 0, lessThan: 3.6, status: unaffected, versionType: custom
version: 4.19.297, lessThanOrEqual: 4.19.*, status: unaffected, versionType: custom
version: 5.4.259, lessThanOrEqual: 5.4.*, status: unaffected, versionType: custom
version: 5.10.199, lessThanOrEqual: 5.10.*, status: unaffected, versionType: custom
version: 5.15.136, lessThanOrEqual: 5.15.*, status: unaffected, versionType: custom
version: 6.1.59, lessThanOrEqual: 6.1.*, status: unaffected, versionType: custom
version: 6.5.8, lessThanOrEqual: 6.5.*, status: unaffected, versionType: custom
version: 6.6, lessThanOrEqual: *, status: unaffected, versionType: original_commit_for_fix
}
