title: net: hso: fix null-ptr-deref during tty device unregistration
description: In the Linux kernel, the following vulnerability has been resolved:
net: hso: fix null-ptr-deref during tty device unregistration
Multiple ttys try to claim the same the minor number causing a double
unregistration of the same device. The first unregistration succeeds
but the next one results in a null-ptr-deref.
The get_free_serial_index() function returns an available minor number
but doesn't assign it immediately. The assignment is done by the caller
later. But before this assignment, calls to get_free_serial_index()
would return the same minor number.
Fix this by modifying get_free_serial_index to assign the minor number
immediately after one is found to be and rename it to obtain_minor()
to better reflect what it does. Similary, rename set_serial_by_index()
to release_minor() and modify it to free up the minor number of the
given hso_serial. Every obtain_minor() should have corresponding
release_minor() call.
affected:
{
product: Linux
vendor: Linux
defaultStatus: unaffected
repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
versions:
version: 72dc1c096c70, lessThan: a462067d7c8e, status: affected, versionType: git
version: 72dc1c096c70, lessThan: 145c89c441d2, status: affected, versionType: git
version: 72dc1c096c70, lessThan: caf5ac93b3b5, status: affected, versionType: git
version: 72dc1c096c70, lessThan: 92028d7a31e5, status: affected, versionType: git
version: 72dc1c096c70, lessThan: 4a2933c88399, status: affected, versionType: git
version: 72dc1c096c70, lessThan: dc195928d7e4, status: affected, versionType: git
version: 72dc1c096c70, lessThan: 388d05f70f1e, status: affected, versionType: git
version: 72dc1c096c70, lessThan: 8a12f8836145, status: affected, versionType: git
}
{
product: Linux
vendor: Linux
defaultStatus: affected
repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
versions:
version: 2.6.27, status: affected
version: 0, lessThan: 2.6.27, status: unaffected, versionType: custom
version: 4.4.268, lessThanOrEqual: 4.4.*, status: unaffected, versionType: custom
version: 4.9.268, lessThanOrEqual: 4.9.*, status: unaffected, versionType: custom
version: 4.14.232, lessThanOrEqual: 4.14.*, status: unaffected, versionType: custom
version: 4.19.187, lessThanOrEqual: 4.19.*, status: unaffected, versionType: custom
version: 5.4.112, lessThanOrEqual: 5.4.*, status: unaffected, versionType: custom
version: 5.10.30, lessThanOrEqual: 5.10.*, status: unaffected, versionType: custom
version: 5.11.14, lessThanOrEqual: 5.11.*, status: unaffected, versionType: custom
version: 5.12, lessThanOrEqual: *, status: unaffected, versionType: original_commit_for_fix
}
