title: ravb: Fix use-after-free issue in ravb_tx_timeout_work()
description: In the Linux kernel, the following vulnerability has been resolved:
ravb: Fix use-after-free issue in ravb_tx_timeout_work()
The ravb_stop() should call cancel_work_sync(). Otherwise,
ravb_tx_timeout_work() is possible to use the freed priv after
ravb_remove() was called like below:
CPU0			CPU1
ravb_tx_timeout()
ravb_remove()
unregister_netdev()
free_netdev(ndev)
// free priv
ravb_tx_timeout_work()
// use priv
unregister_netdev() will call .ndo_stop() so that ravb_stop() is
called. And, after phy_stop() is called, netif_carrier_off()
is also called. So that .ndo_tx_timeout() will not be called
after phy_stop().
affected:
{
product: Linux
vendor: Linux
defaultStatus: unaffected
repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
versions:
version: c156633f1353, lessThan: 65d34cfd4e34, status: affected, versionType: git
version: c156633f1353, lessThan: db9aafa19547, status: affected, versionType: git
version: c156633f1353, lessThan: 616761cf9df9, status: affected, versionType: git
version: c156633f1353, lessThan: 6f6fa8061f75, status: affected, versionType: git
version: c156633f1353, lessThan: 105abd68ad8f, status: affected, versionType: git
version: c156633f1353, lessThan: 397144287071, status: affected, versionType: git
}
{
product: Linux
vendor: Linux
defaultStatus: affected
repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
versions:
version: 4.2, status: affected
version: 0, lessThan: 4.2, status: unaffected, versionType: custom
version: 5.4.259, lessThanOrEqual: 5.4.*, status: unaffected, versionType: custom
version: 5.10.199, lessThanOrEqual: 5.10.*, status: unaffected, versionType: custom
version: 5.15.136, lessThanOrEqual: 5.15.*, status: unaffected, versionType: custom
version: 6.1.59, lessThanOrEqual: 6.1.*, status: unaffected, versionType: custom
version: 6.5.8, lessThanOrEqual: 6.5.*, status: unaffected, versionType: custom
version: 6.6, lessThanOrEqual: *, status: unaffected, versionType: original_commit_for_fix
}
