CVE-2017-8246 — Use After Free in Linux

CWE-416 — Use After Free5 documents5 sources
Severity
7.8HIGHNVD
EPSS
0.0%
top 91.07%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
5
Debian LinuxGoogle AndroidMsrc CBL Mariner 1.0 ARM+2 more
Timeline
PublishedMay 12
Latest updateMay 13

Description

In function msm_pcm_playback_close() in all Android releases from CAF using the Linux kernel, prtd is assigned substream->runtime->private_data. Later, prtd is freed. However, prtd is not sanitized and set to NULL, resulting in a dangling pointer. There are other functions that access the same memory (substream->runtime->private_data) with a NULL check, such as msm_pcm_volume_ctl_put(), which means this freed memory could be used.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 1.8 | Impact: 5.9

Affected Packages5 packages

▶debiandebian/linux

🔴Vulnerability Details

1
GHSA
GHSA-qx82-prw3-cr2g: In function msm_pcm_playback_close() in all Android releases from CAF using the Linux kernel, prtd is assigned substream->runtime->private_data↗2022-05-13
▶

📋Vendor Advisories

3
Android
CVE-2017-8246: Sound driver↗2017-07-01
▶
Microsoft
In function msm_pcm_playback_close() in all Android releases from CAF using the Linux kernel prtd is assigned substream->runtime->private_data. Later prtd is freed. However prtd is not sanitized and s↗2017-05-09
▶
Debian
CVE-2017-8246: linux - In function msm_pcm_playback_close() in all Android releases from CAF using the ...↗2017
▶