In the Linux kernel, the following vulnerability has been resolved:
USB: gadget: ffs: fix mm lifetime handling
io_data stores a pointer to the submitting task's mm_struct,
but does not currently hold a reference to it while async
requests are pending.
This can result in a use-after-free if the task exits before
completion handling finishes.
Take a reference with mmgrab() when queuing the read request
and release it with mmdrop() on request completion.
Attack Parameters
Attack Vector
Local
Requires local access
Attack Complexity
Low
Easy to exploit
Privileges Required
Low
Basic privileges needed
User Interaction
None
No user interaction needed
Impact Assessment
Confidentiality
High
Complete data leak
Integrity
High
Complete data modification
Availability
High
Complete denial of service
CVSS Vector v3.1
References 3
https://git.kernel.org/stable/c/5eb5c72c72fef76cb765ef1669b62b6a3ba1bfc8
416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/7411de0ce3b45286de1de82526795658ea6eacb0
416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/f3d31484b3f26d63c09e5569ebfaa1079a17f171
416baaa9-dc9f-4396-8d5f-8c081fb06d67