Headline
Linux Dangling PFN Mapping / Use-After-Free
An error path in usbdev_mmap() (where remap_pfn_range() fails midway through) frees pages before the PFN mapping pointing to those pages is cleaned up, making physical page use-after-free possible. Some other drivers look like they might have similar issues.
© 2024 Packet Storm. All rights reserved.