Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Security Vulnerability - Action Required: Use After Free vulnerability may in your project #803

Open
Crispy-fried-chicken opened this issue Sep 7, 2024 · 0 comments

Comments

@Crispy-fried-chicken
Copy link

Hi,
we have detected that your project may be vulnerable to Use After Free in the function of outbound_phy_packet_callback in the file of trunk/linux-3.4.x/drivers/firewire/core-cdev.c . It shares similarities to a recent CVE disclosure CVE-2023-3159 in the linux.

The source vulnerability information is as follows:

Vulnerability Detail:
CVE Identifier: CVE-2023-3159
Description: A use after free issue was discovered in driver/firewire in outbound_phy_packet_callback in the Linux Kernel. In this flaw a local attacker with special privilege may cause a use after free problem when queue_event() fails.
Reference: https://nvd.nist.gov/vuln/detail/CVE-2023-3159
Patch: torvalds/linux@b7c81f8

Would you help to check if this bug is true? If it's true, I'd like to open a PR for that if necessary. Thank you for your effort and patience!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant