Use-after-free vulnerability in the disk_seqf_stop function in block/genhd.c in the Linux kernel before 4.7.1 allows local users to gain privileges by leveraging the execution of a certain stop operation even if the corresponding start operation had failed.
The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
| Link | Tags |
|---|---|
| https://github.com/torvalds/linux/commit/77da160530dd1dc94f6ae15a981f24e5f0021e84 | exploit patch vendor advisory |
| https://access.redhat.com/errata/RHSA-2017:1308 | third party advisory vendor advisory |
| http://source.android.com/security/bulletin/2016-11-01.html | third party advisory |
| https://access.redhat.com/errata/RHSA-2017:0892 | third party advisory vendor advisory |
| http://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.7.1 | release notes |
| http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=77da160530dd1dc94f6ae15a981f24e5f0021e84 | exploit patch vendor advisory |
| https://access.redhat.com/errata/RHSA-2017:1298 | third party advisory vendor advisory |
| http://www.securityfocus.com/bid/94135 | vdb entry third party advisory |
| https://access.redhat.com/errata/RHSA-2017:1297 | third party advisory vendor advisory |