Re: CVE-2021-46966: ACPI: custom_method: fix potential use-after-free issue

[Greg Kroah-Hartman]

On Wed, Feb 28, 2024 at 05:14:22PM +0100, Michal Hocko wrote:
> Hi,
> this seems like another example of a reasonable fix with a very dubious
> CVE IMHO. Allowing access to /sys/kernel/debug/acpi/custom_method to
> anybody but trusted actor is a huge security problem on its own. I
> really fail to see any value marking this clear bug fix as security
> related.

It was picked because it was a use-after-free fix, AND it is part of the
"import the GSD database into the CVE database" that the CVE project
asked us to do.

thanks,

greg k-h