Title: Linux, Description: En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:

pmdomain: mediatek: soluciona el uso después de liberación en scpsys_get_bus_protection_legacy()

En scpsys_get_bus_protection_legacy(), of_find_node_with_property() devuelve un nodo de dispositivo con su contador de referencias incrementado. La función luego llama a of_node_put(node) antes de verificar si syscon_regmap_lookup_by_phandle() devuelve un error. Si ocurre un error, dev_err_probe() desreferencia el puntero del nodo para imprimir información de diagnóstico, pero la memoria del nodo puede haber sido liberada ya debido a la llamada anterior a of_node_put(), lo que lleva a una vulnerabilidad de uso después de liberación.

Esto se soluciona moviendo la llamada a of_node_put() después de la verificación de errores, asegurando que el nodo siga siendo válido cuando se accede a él en la ruta de error.

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE-416

OR
          *cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:*
          *cpe:2.3:o:linux:linux_kernel:7.1:rc2:*:*:*:*:*:*
          *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.19 up to (excluding) 7.0.7
          *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.18 up to (excluding) 6.18.30

kernel.org: https://git.kernel.org/stable/c/38d8410021b55d226847b2ac8d189d89fe5a8866 Types: Patch

kernel.org: https://git.kernel.org/stable/c/cb27e43c0511e9e1ca8818d231656070b11c18cf Types: Patch

kernel.org: https://git.kernel.org/stable/c/ec1fcddb3117d9452210e838fd37389ee61e10e8 Types: Patch

[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/pmdomain/mediatek/mtk-pm-domains.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"c29345fa5f66bea0790cf2219f57b974d4fc177b","lessThan":"cb27e43c0511e9e1ca8818d231656070b11c18cf","versionType":"git","status":"affected"},{"version":"c29345fa5f66bea0790cf2219f57b974d4fc177b","lessThan":"38d8410021b55d226847b2ac8d189d89fe5a8866","versionType":"git","status":"affected"},{"version":"c29345fa5f66bea0790cf2219f57b974d4fc177b","lessThan":"ec1fcddb3117d9452210e838fd37389ee61e10e8","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/pmdomain/mediatek/mtk-pm-domains.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.18","status":"affected"},{"version":"0","lessThan":"6.18","versionType":"semver","status":"unaffected"},{"version":"6.18.30","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.0.7","lessThanOrEqual":"7.0.*","versionType":"semver","status":"unaffected"},{"version":"7.1","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]

In the Linux kernel, the following vulnerability has been resolved:

pmdomain: mediatek: fix use-after-free in scpsys_get_bus_protection_legacy()

In scpsys_get_bus_protection_legacy(), of_find_node_with_property()
returns a device node with its reference count incremented. The function
then calls of_node_put(node) before checking whether
syscon_regmap_lookup_by_phandle() returns an error. If an error occurs,
dev_err_probe() dereferences the node pointer to print diagnostic
information, but the node memory may have already been freed due to the
earlier of_node_put(), leading to a use-after-free vulnerability.

Fix this by moving the of_node_put() call after the error check, ensuring
the node is still valid when accessed in the error path.

https://git.kernel.org/stable/c/38d8410021b55d226847b2ac8d189d89fe5a8866

https://git.kernel.org/stable/c/cb27e43c0511e9e1ca8818d231656070b11c18cf

https://git.kernel.org/stable/c/ec1fcddb3117d9452210e838fd37389ee61e10e8