CVE-2023-53826

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> ubi: Fix UAF wear-leveling entry in eraseblk_count_seq_show()<br /> <br /> Wear-leveling entry could be freed in error path, which may be accessed<br /> again in eraseblk_count_seq_show(), for example:<br /> <br /> __erase_worker eraseblk_count_seq_show<br /> wl = ubi-&gt;lookuptbl[*block_number]<br /> if (wl)<br /> wl_entry_destroy<br /> ubi-&gt;lookuptbl[e-&gt;pnum] = NULL<br /> kmem_cache_free(ubi_wl_entry_slab, e)<br /> erase_count = wl-&gt;ec // UAF!<br /> <br /> Wear-leveling entry updating/accessing in ubi-&gt;lookuptbl should be<br /> protected by ubi-&gt;wl_lock, fix it by adding ubi-&gt;wl_lock to serialize<br /> wl entry accessing between wl_entry_destroy() and<br /> eraseblk_count_seq_show().<br /> <br /> Fetch a reproducer in [Link].