In the Linux kernel, the following vulnerability has been resolved:
spi: mpc52xx: Add cancelworksync before module remove
If we remove the module which will call mpc52xxspiremove it will free 'ms' through spiunregistercontroller. while the work ms->work will be used. The sequence of operations that may lead to a UAF bug.
Fix it by ensuring that the work is canceled before proceeding with the cleanup in mpc52xxspiremove.
[
{
"deprecated": false,
"target": {
"file": "drivers/spi/spi-mpc52xx.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"164512467898833177023014556345788215003",
"216142499650004151866064531829861634871",
"326822232386773101166442756612078604089"
]
},
"id": "CVE-2024-50051-23cc843d",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f65d85bc1ffd8a2c194bb2cd65e35ed3648ddd59",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"file": "drivers/spi/spi-mpc52xx.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"164512467898833177023014556345788215003",
"216142499650004151866064531829861634871",
"326822232386773101166442756612078604089"
]
},
"id": "CVE-2024-50051-47d3b6d1",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d0cde3911cf24e1bcdd4caa1d1b9ef57589db5a1",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"file": "drivers/spi/spi-mpc52xx.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"164512467898833177023014556345788215003",
"216142499650004151866064531829861634871",
"326822232386773101166442756612078604089"
]
},
"id": "CVE-2024-50051-737b17f9",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@cd5106c77d6d6828aa82449f01f4eb436d602a21",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"file": "drivers/spi/spi-mpc52xx.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"65349355126267969133087327155948605666",
"87458129495036551050454096014454655034",
"326822232386773101166442756612078604089"
]
},
"id": "CVE-2024-50051-761a0e63",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@984836621aad98802d92c4a3047114cf518074c8",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"file": "drivers/spi/spi-mpc52xx.c",
"function": "mpc52xx_spi_remove"
},
"digest": {
"length": 400.0,
"function_hash": "116151079667645055156990792948842963960"
},
"id": "CVE-2024-50051-903b94ee",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@cd5106c77d6d6828aa82449f01f4eb436d602a21",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"file": "drivers/spi/spi-mpc52xx.c",
"function": "mpc52xx_spi_remove"
},
"digest": {
"length": 400.0,
"function_hash": "116151079667645055156990792948842963960"
},
"id": "CVE-2024-50051-9b604332",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d0cde3911cf24e1bcdd4caa1d1b9ef57589db5a1",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"file": "drivers/spi/spi-mpc52xx.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"164512467898833177023014556345788215003",
"216142499650004151866064531829861634871",
"326822232386773101166442756612078604089"
]
},
"id": "CVE-2024-50051-b9173ac2",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@373d55a47dc662e5e30d12ad5d334312f757c1f1",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"file": "drivers/spi/spi-mpc52xx.c",
"function": "mpc52xx_spi_remove"
},
"digest": {
"length": 389.0,
"function_hash": "178067180585878955679581348982370822124"
},
"id": "CVE-2024-50051-bee66aa7",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@984836621aad98802d92c4a3047114cf518074c8",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"file": "drivers/spi/spi-mpc52xx.c",
"function": "mpc52xx_spi_remove"
},
"digest": {
"length": 400.0,
"function_hash": "116151079667645055156990792948842963960"
},
"id": "CVE-2024-50051-cbcb79bc",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@373d55a47dc662e5e30d12ad5d334312f757c1f1",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"file": "drivers/spi/spi-mpc52xx.c",
"function": "mpc52xx_spi_remove"
},
"digest": {
"length": 389.0,
"function_hash": "178067180585878955679581348982370822124"
},
"id": "CVE-2024-50051-ee3975a1",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f65d85bc1ffd8a2c194bb2cd65e35ed3648ddd59",
"signature_version": "v1"
}
]