drivers/net/wireless/rsi/rsi_91x_usb.c in the Linux kernel through 5.2.9 has a Double Free via crafted USB device traffic (which may be remote via usbip or usbredir).
The product calls free() twice on the same memory address, potentially leading to modification of unexpected memory locations.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Linux_kernel | Linux | 4.17 (including) | 4.19.74 (excluding) |
| Linux_kernel | Linux | 4.20 (including) | 5.2.16 (excluding) |
| Linux | Ubuntu | disco | * |
| Linux | Ubuntu | esm-infra-legacy/trusty | * |
| Linux | Ubuntu | precise/esm | * |
| Linux | Ubuntu | trusty | * |
| Linux | Ubuntu | trusty/esm | * |
| Linux | Ubuntu | upstream | * |
| Linux-aws | Ubuntu | disco | * |
| Linux-aws | Ubuntu | esm-infra-legacy/trusty | * |
| Linux-aws | Ubuntu | trusty | * |
| Linux-aws | Ubuntu | trusty/esm | * |
| Linux-aws | Ubuntu | upstream | * |
| Linux-aws-5.0 | Ubuntu | upstream | * |
| Linux-aws-hwe | Ubuntu | upstream | * |
| Linux-azure | Ubuntu | bionic | * |
| Linux-azure | Ubuntu | disco | * |
| Linux-azure | Ubuntu | esm-infra-legacy/trusty | * |
| Linux-azure | Ubuntu | trusty | * |
| Linux-azure | Ubuntu | trusty/esm | * |
| Linux-azure | Ubuntu | upstream | * |
| Linux-azure-5.3 | Ubuntu | upstream | * |
| Linux-azure-edge | Ubuntu | bionic | * |
| Linux-azure-edge | Ubuntu | upstream | * |
| Linux-gcp | Ubuntu | bionic | * |
| Linux-gcp | Ubuntu | disco | * |
| Linux-gcp | Ubuntu | upstream | * |
| Linux-gcp-5.3 | Ubuntu | upstream | * |
| Linux-gcp-edge | Ubuntu | bionic | * |
| Linux-gcp-edge | Ubuntu | upstream | * |
| Linux-gke-4.15 | Ubuntu | upstream | * |
| Linux-gke-5.0 | Ubuntu | bionic | * |
| Linux-gke-5.0 | Ubuntu | upstream | * |
| Linux-gke-5.3 | Ubuntu | upstream | * |
| Linux-hwe | Ubuntu | bionic | * |
| Linux-hwe | Ubuntu | upstream | * |
| Linux-hwe-edge | Ubuntu | bionic | * |
| Linux-hwe-edge | Ubuntu | esm-infra/bionic | * |
| Linux-hwe-edge | Ubuntu | upstream | * |
| Linux-kvm | Ubuntu | disco | * |
| Linux-kvm | Ubuntu | upstream | * |
| Linux-lts-trusty | Ubuntu | precise/esm | * |
| Linux-lts-trusty | Ubuntu | upstream | * |
| Linux-lts-xenial | Ubuntu | esm-infra-legacy/trusty | * |
| Linux-lts-xenial | Ubuntu | trusty | * |
| Linux-lts-xenial | Ubuntu | trusty/esm | * |
| Linux-lts-xenial | Ubuntu | upstream | * |
| Linux-oem | Ubuntu | upstream | * |
| Linux-oem | Ubuntu | xenial | * |
| Linux-oem-5.6 | Ubuntu | upstream | * |
| Linux-oem-osp1 | Ubuntu | bionic | * |
| Linux-oem-osp1 | Ubuntu | disco | * |
| Linux-oem-osp1 | Ubuntu | eoan | * |
| Linux-oem-osp1 | Ubuntu | upstream | * |
| Linux-oracle | Ubuntu | disco | * |
| Linux-oracle | Ubuntu | upstream | * |
| Linux-oracle-5.0 | Ubuntu | upstream | * |
| Linux-oracle-5.3 | Ubuntu | upstream | * |
| Linux-raspi2 | Ubuntu | disco | * |
| Linux-raspi2 | Ubuntu | upstream | * |
| Linux-raspi2-5.3 | Ubuntu | upstream | * |
| Linux-snapdragon | Ubuntu | disco | * |
| Linux-snapdragon | Ubuntu | upstream | * |