Linux Kernel Use-After-Free Vulnerability in IIO Buffer Hardware Consumer

A use-after-free vulnerability has been identified in the Linux kernel's IIO (Industrial Input/Output) buffer hardware consumer management. This issue arises in the 'iio_hw_consumer_alloc()' function, where the code improperly manages buffer references. During the error handling process, the function iterates through buffers using 'list_for_each_entry()'. While doing so, it calls 'iio_buffer_put()', which can free the current buffer if its reference count drops to zero. The iteration then attempts to access the next buffer in the list, leading to the potential use of a freed memory area. The vulnerability affects the Linux kernel stable group.

Impact

Exploitation of this vulnerability can lead to a use-after-free condition, where the program continues to use a memory resource that has already been released. This can cause undefined behavior, including memory corruption, crashes, or the execution of malicious code.

Reproduction

The vulnerability can be reproduced by allocating an IIO hardware consumer buffer using the 'iio_hw_consumer_alloc()' function' and then triggering an error that invokes the 'err_put_buffers' cleanup path. This will cause the function to iterate through the buffers and free them while still in the loop, leading to a use-after-free condition.

Remediation

The vulnerability has been fixed in the Linux kernel. Users should upgrade to the latest version where this issue has been addressed.