7.8

CVE-2022-49388

ubi: ubi_create_volume: Fix use-after-free when volume creation failed

In the Linux kernel, the following vulnerability has been resolved:

ubi: ubi_create_volume: Fix use-after-free when volume creation failed

There is an use-after-free problem for 'eba_tbl' in ubi_create_volume()'s
error handling path:

  ubi_eba_replace_table(vol, eba_tbl)
    vol->eba_tbl = tbl
out_mapping:
  ubi_eba_destroy_table(eba_tbl)   // Free 'eba_tbl'
out_unlock:
  put_device(&vol->dev)
    vol_release
      kfree(tbl->entries)	  // UAF

Fix it by removing redundant 'eba_tbl' releasing.
Fetch a reproducer in [Link].
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Linux ≫ Linux Kernel Version >= 4.12 < 4.14.283
Linux ≫ Linux Kernel Version >= 4.15 < 4.19.247
Linux ≫ Linux Kernel Version >= 4.20 < 5.4.198
Linux ≫ Linux Kernel Version >= 5.5 < 5.10.122
Linux ≫ Linux Kernel Version >= 5.11 < 5.15.47
Linux ≫ Linux Kernel Version >= 5.16 < 5.17.15
Linux ≫ Linux Kernel Version >= 5.18 < 5.18.4
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.28% 0.201
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
134c704f-9b21-4f2e-91b3-4a467353bcc0 7.8 1.8 5.9
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE-416 Use After Free

The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

https://git.kernel.org/stable/c/1174ab8ba36a48025b68b5ff1085000b1e510217
Patch
https://git.kernel.org/stable/c/25ff1e3a1351c0d936dd1ac2f9e58231ea1510c9
Patch
https://git.kernel.org/stable/c/5ff2514e4fb55dcf3d88294686040ca73ea0c1a2
Patch
https://git.kernel.org/stable/c/6d8d3f68cbecfd31925796f0fb668eb21ab06734
Patch
https://git.kernel.org/stable/c/8302620aeb940f386817321d272b12411ae7d39f
Patch
https://git.kernel.org/stable/c/8c03a1c21d72210f81cb369cc528e3fde4b45411
Patch
https://git.kernel.org/stable/c/abb67043060f2bf4c03d7c3debb9ae980e2b6db3
Patch
https://git.kernel.org/stable/c/e27ecf325e51abd06aaefba57a6322a46fa4178b
Patch