Executive brief
A vulnerability exists in the Linux kernel driver for Microchip WILC1000 wireless network chips. When the system attempts to remove the driver or clean up network interfaces, it may incorrectly access memory that has already been deleted. This could lead to a system crash or allow a local user to potentially gain unauthorized control over the system.
Technical details
A use-after-free (UAF) vulnerability exists in the wilc1000 driver within the wilc_netdev_cleanup function. The root cause is the unregistration of a net device during a RCU list traversal of virtual interfaces (vif). When unregister_netdev is called, the netdevice object and its associated private data (the vif object) are freed, but the loop continues to use the freed vif pointer to navigate the list. This can be triggered by unbinding the device from the driver via sysfs or during interface registration error paths. The fix involves using list_for_each_entry_safe and ensuring RCU grace periods are respected with synchronize_srcu before proceeding with unregistration.
Affected products
- Linux Linux Kernel 5.5 to 5.10.213, 5.11 to 5.15.152, 5.16 to 6.1.82, 6.2 to 6.6.22, 6.7 to 6.7.10, 6.8
Timeline
- 2024-02-12: patched: Initial patch submitted by Alexis Lothoré
- 2024-04-17: disclosed: CVE-2024-26895 published
References
- https://git.kernel.org/stable/c/24228dcf1d30c2231caa332be7d3090ac59fbfe9
- https://git.kernel.org/stable/c/3da9d32b7f4a1a9f7e4bb15bb82f2b2dd6719447
- https://git.kernel.org/stable/c/5956f4203b6cdd0755bbdd21b45f3933c7026208
- https://git.kernel.org/stable/c/73a2aa0aef86c2c07be5a2f42c9e6047e1a2f7bb
- https://git.kernel.org/stable/c/a9545af2a533739ffb64d6c9a6fec6f13e2b505f
- https://git.kernel.org/stable/c/cb5942b77c05d54310a0420cac12935e9b6aa21c
- https://git.kernel.org/stable/c/fe20e3d56bc911408fc3c27a17c59e9d7885f7d1