title: ieee802154: ca8210: Fix a potential UAF in ca8210_probe
description: In the Linux kernel, the following vulnerability has been resolved:
ieee802154: ca8210: Fix a potential UAF in ca8210_probe
If of_clk_add_provider() fails in ca8210_register_ext_clock(),
it calls clk_unregister() to release priv->clk and returns an
error. However, the caller ca8210_probe() then calls ca8210_remove(),
where priv->clk is freed again in ca8210_unregister_ext_clock(). In
this case, a use-after-free may happen in the second time we call
clk_unregister().
Fix this by removing the first clk_unregister(). Also, priv->clk could
be an error code on failure of clk_register_fixed_rate(). Use
IS_ERR_OR_NULL to catch this case in ca8210_unregister_ext_clock().
affected:
{
product: Linux
vendor: Linux
defaultStatus: unaffected
repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
versions:
version: ded845a781a5, lessThan: 28b68cba378e, status: affected, versionType: git
version: ded845a781a5, lessThan: cdb46be93c1f, status: affected, versionType: git
version: ded845a781a5, lessThan: 85c2857ef900, status: affected, versionType: git
version: ded845a781a5, lessThan: 55e06850c789, status: affected, versionType: git
version: ded845a781a5, lessThan: 84c6aa0ae5c4, status: affected, versionType: git
version: ded845a781a5, lessThan: 217efe32a452, status: affected, versionType: git
version: ded845a781a5, lessThan: becf5c147198, status: affected, versionType: git
version: ded845a781a5, lessThan: f990874b1c98, status: affected, versionType: git
}
{
product: Linux
vendor: Linux
defaultStatus: affected
repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
versions:
version: 4.12, status: affected
version: 0, lessThan: 4.12, status: unaffected, versionType: custom
version: 4.14.328, lessThanOrEqual: 4.14.*, status: unaffected, versionType: custom
version: 4.19.297, lessThanOrEqual: 4.19.*, status: unaffected, versionType: custom
version: 5.4.259, lessThanOrEqual: 5.4.*, status: unaffected, versionType: custom
version: 5.10.199, lessThanOrEqual: 5.10.*, status: unaffected, versionType: custom
version: 5.15.136, lessThanOrEqual: 5.15.*, status: unaffected, versionType: custom
version: 6.1.59, lessThanOrEqual: 6.1.*, status: unaffected, versionType: custom
version: 6.5.8, lessThanOrEqual: 6.5.*, status: unaffected, versionType: custom
version: 6.6, lessThanOrEqual: *, status: unaffected, versionType: original_commit_for_fix
}
