In the Linux kernel, the following vulnerability has been resolved:
media: rc: sunxi-cir: Unregister rc device on probe failure
After rc_register_device() succeeds, later probe failures must undo the
registration with rc_unregister_device(). The current error path jumps to
the allocation cleanup label and only calls rc_free_device(), leaving the
rc device registration and resources created by rc_register_device()
behind.
Add a registered-device unwind label for the IRQ lookup, IRQ request, and
hardware initialization failure paths. Keep rc_free_device() for failures
before rc_register_device() succeeds.
CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS Score: 7.8
AV:L - The bug is in sunxi_ir_probe() of the Allwinner CIR platform driver; after a failed probe the leftover rc-core/lirc/input device is reached by opening local /dev/lirc or /dev/input/event nodes, not via network packets, Bluetooth, or IR/USB injection.
AC:L - After rc_register_device() succeeds, IRQ lookup (including -EPROBE_DEFER), request_irq, or sunxi_ir_hw_init failure calls only rc_free_device(); once the leaked rc/lirc node exists, LIRC_SET_REC_TIMEOUT and similar ioctls deterministically use dangling rc_dev->priv with no attacker-uncontrollable race.
PR:L - A low-privileged local user who can open the leaked /dev/lirc* or input event node (typical input-group/udev access on Allwinner STBs, tablets, and SBCs) can ioctl the leftover rc device; bind/unbind is CAP_SYS_ADMIN, but the higher-severity scenario is exploiting an already leaked node.
UI:N - The attacker opens the leftover lirc or input device and issues ioctls themselves; no victim must mount a filesystem, plug a device, or otherwise interact.
S:U - Use-after-free of the probe-owned sunxi_ir object and leftover rc-core state stays in the host kernel and does not cross a VM, IOMMU, or sandbox boundary.
C:H - Failed probe leaves the rc device registered while devres frees the sunxi_ir object that rc_dev->priv still points at, a slab use-after-free; per kernel CVSS guidance that primitive enables arbitrary kernel read.
I:H - sunxi_ir_set_timeout() performs CIR MMIO writes through freed ir->base, and leftover s_timeout/ir_raw callbacks can be redirected after heap reuse, yielding arbitrary write and control-flow hijack.
A:H - Using the leftover lirc/input node dereferences freed sunxi_ir state or writes unmapped CIR MMIO, causing kernel oops/panic; any use-after-free is high availability impact.
| Attack Vector |
Local |
Scope |
Unchanged |
| Attack Complexity |
Low |
Confidentiality Impact |
High |
| Privileges Required |
Low |
Integrity Impact |
High |
| User Interaction |
None |
Availability Impact |
High |
AV:L - The bug is in sunxi_ir_probe() of the Allwinner CIR platform driver; after a failed probe the leftover rc-core/lirc/input device is reached by opening local /dev/lirc or /dev/input/event nodes, not via network packets, Bluetooth, or IR/USB injection.
AC:L - After rc_register_device() succeeds, IRQ lookup (including -EPROBE_DEFER), request_irq, or sunxi_ir_hw_init failure calls only rc_free_device(); once the leaked rc/lirc node exists, LIRC_SET_REC_TIMEOUT and similar ioctls deterministically use dangling rc_dev->priv with no attacker-uncontrollable race.
PR:L - A low-privileged local user who can open the leaked /dev/lirc* or input event node (typical input-group/udev access on Allwinner STBs, tablets, and SBCs) can ioctl the leftover rc device; bind/unbind is CAP_SYS_ADMIN, but the higher-severity scenario is exploiting an already leaked node.
UI:N - The attacker opens the leftover lirc or input device and issues ioctls themselves; no victim must mount a filesystem, plug a device, or otherwise interact.
S:U - Use-after-free of the probe-owned sunxi_ir object and leftover rc-core state stays in the host kernel and does not cross a VM, IOMMU, or sandbox boundary.
C:H - Failed probe leaves the rc device registered while devres frees the sunxi_ir object that rc_dev->priv still points at, a slab use-after-free; per kernel CVSS guidance that primitive enables arbitrary kernel read.
I:H - sunxi_ir_set_timeout() performs CIR MMIO writes through freed ir->base, and leftover s_timeout/ir_raw callbacks can be redirected after heap reuse, yielding arbitrary write and control-flow hijack.
A:H - Using the leftover lirc/input node dereferences freed sunxi_ir state or writes unmapped CIR MMIO, causing kernel oops/panic; any use-after-free is high availability impact.
CVSS 3.1