A use-after-free read in the Linux kernel before 5.9.10 could be used by local attackers to read privileged information or potentially crash the kernel. The function sunkbd_reinit was scheduled by sunkbd_interrupt before the struct sunkbd was freed. Though the dangling pointer is set to NULL in sunkbd_disconnect, there is still an alias in sunkbd_reinit causing use-after-free.
A use-after-free read in the Linux kernel before 5.9.10 could be used by local attackers to read privileged information or potentially crash the kernel. The function sunkbd_reinit was scheduled by sunkbd_interrupt before the struct sunkbd was freed. Though the dangling pointer is set to NULL in sunkbd_disconnect, there is still an alias in sunkbd_reinit causing use-after-free.
https://www.openwall.com/lists/oss-security/2020/11/05/2 https://www.openwall.com/lists/oss-security/2020/11/20/5 https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=77e70d351db7de07a46ac49b87a6c3c7a60fca7e
Vulmon