Use After Free Affecting kernel-debuginfo package, versions <0:4.14.291-218.527.amzn2
Threat Intelligence
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-AMZN2-KERNELDEBUGINFO-7446696
- published 13 Jul 2024
- disclosed 26 Feb 2024
Introduced: 26 Feb 2024
CVE-2019-25162 Open this link in a new tabHow to fix?
Upgrade Amazon-Linux:2 kernel-debuginfo to version 0:4.14.291-218.527.amzn2 or higher.
This issue was patched in ALAS2-2022-1838.
NVD Description
Note: Versions mentioned in the description apply only to the upstream kernel-debuginfo package and not the kernel-debuginfo package as distributed by Amazon-Linux.
See How to fix? for Amazon-Linux:2 relevant fixed versions and status.
In the Linux kernel, the following vulnerability has been resolved:
i2c: Fix a potential use after free
Free the adap structure only after we are done using it. This patch just moves the put_device() down a bit to avoid the use after free.
[wsa: added comment to the code, added Fixes tag]
References
- http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-25162
- https://git.kernel.org/stable/c/12b0606000d0828630c033bf0c74c748464fe87d
- https://git.kernel.org/stable/c/23a191b132cd87f746c62f3dc27da33683d85829
- https://git.kernel.org/stable/c/35927d7509ab9bf41896b7e44f639504eae08af7
- https://git.kernel.org/stable/c/81cb31756888bb062e92d2dca21cd629d77a46a9
- https://git.kernel.org/stable/c/871a1e94929a27bf6e2cd99523865c840bbc2d87
- https://git.kernel.org/stable/c/e4c72c06c367758a14f227c847f9d623f1994ecf
- https://git.kernel.org/stable/c/e6412ba3b6508bdf9c074d310bf4144afa6aec1a
- https://git.kernel.org/stable/c/e8e1a046cf87c8b1363e5de835114f2779e2aaf4