Jeff Johnson

A use-after-free vulnerability has been resolved in the Linux kernel, specifically in the ath12k module. The issue occurs during the removal of the ath12k module, where the `ath12k mac destroy()` function un-registers the `ah->hw` from mac80211 and frees the `ah->hw` as well as all the `ar`'s in it. Later, the `ath12k dp cc cleanup()` function tries to access one of the freed `ar`'s from a pending `skb`, leading to a use-after-free error. This is because the driver failed to flush a few data packets during the destruction of the mac, which were accessed later and freed. The vulnerability was introduced by a commit that added a change to decrement the pending packets count in case of recovery, but this change does not make sense during core deinit.

A logic issue was addressed with improved checks. A malicious app may be able to modify other apps without having App Management permission.

The issue is related to improved memory handling and may lead to arbitrary code execution when processing web content. A remote attacker may exploit this issue to access confidential data, compromise data integrity, and cause a denial of service.

The issue is related to the wifi: ath11k: fix dfs radar event locking in the Linux kernel. The ath11k active pdevs are protected by RCU, but the DFS radar event handling code calling `ath11k mac get ar by pdev id()` was not marked as a read-side critical section. This could lead to potential use-after-free issues. The code in question has been marked as an RCU read-side critical section to avoid these issues.

An authorization issue was addressed with improved state management. This issue may allow an app to retain access to system configuration files even after its permission is revoked, potentially allowing an attacker to access confidential information and preserve user data.

An issue existed with the file paths used to store website data, potentially allowing an unauthorized user to access browsing history. The issue was resolved by improving how website data is stored and by addressing the issue with improved handling of caches.

A malicious application may be able to access restricted files due to an issue that was addressed by removing additional entitlements.

The issue is related to a memory allocation problem in the AFCTR Tool. The impact of this problem is unknown.