5.5
CVE-2023-53271
- EPSS 0.15%
- Veröffentlicht 16.09.2025 08:07:00
- Zuletzt bearbeitet 14.01.2026 19:16:18
- Quelle 416baaa9-dc9f-4396-8d5f-8c081f
- CVE-Watchlists
- Unerledigt
ubi: Fix unreferenced object reported by kmemleak in ubi_resize_volume()
In the Linux kernel, the following vulnerability has been resolved: ubi: Fix unreferenced object reported by kmemleak in ubi_resize_volume() There is a memory leaks problem reported by kmemleak: unreferenced object 0xffff888102007a00 (size 128): comm "ubirsvol", pid 32090, jiffies 4298464136 (age 2361.231s) hex dump (first 32 bytes): ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ................ ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ................ backtrace: [<ffffffff8176cecd>] __kmalloc+0x4d/0x150 [<ffffffffa02a9a36>] ubi_eba_create_table+0x76/0x170 [ubi] [<ffffffffa029764e>] ubi_resize_volume+0x1be/0xbc0 [ubi] [<ffffffffa02a3321>] ubi_cdev_ioctl+0x701/0x1850 [ubi] [<ffffffff81975d2d>] __x64_sys_ioctl+0x11d/0x170 [<ffffffff83c142a5>] do_syscall_64+0x35/0x80 [<ffffffff83e0006a>] entry_SYSCALL_64_after_hwframe+0x46/0xb0 This is due to a mismatch between create and destroy interfaces, and in detail that "new_eba_tbl" created by ubi_eba_create_table() but destroyed by kfree(), while will causing "new_eba_tbl->entries" not freed. Fix it by replacing kfree(new_eba_tbl) with ubi_eba_destroy_table(new_eba_tbl)
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Linux ≫ Linux Kernel Version >= 4.9 < 4.14.308
Linux ≫ Linux Kernel Version >= 4.15 < 4.19.276
Linux ≫ Linux Kernel Version >= 4.20 < 5.4.235
Linux ≫ Linux Kernel Version >= 5.5 < 5.10.173
Linux ≫ Linux Kernel Version >= 5.11 < 5.15.100
Linux ≫ Linux Kernel Version >= 5.16 < 6.1.18
Linux ≫ Linux Kernel Version >= 6.2 < 6.2.5
VulnDex Vulnerability Enrichment
| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.15% | 0.043 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| nvd@nist.gov | 5.5 | 1.8 | 3.6 |
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
|
| 134c704f-9b21-4f2e-91b3-4a467353bcc0 | 5.5 | 1.8 | 3.6 |
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
|
CWE-401 Missing Release of Memory after Effective Lifetime
The product does not sufficiently track and release allocated memory after it has been used, making the memory unavailable for reallocation and reuse.
https://git.kernel.org/stable/c/09780a44093b53f9cbca76246af2e4ff0884e512
https://git.kernel.org/stable/c/26ec2d66aecab8ff997b912c20247fedba4f5740
https://git.kernel.org/stable/c/07b60f7452d2fa731737552937cb81821919f874
https://git.kernel.org/stable/c/31d60afe2cc2b712dbefcaab6b7d6a47036f844e
https://git.kernel.org/stable/c/95a72417dd13ebcdcb1bd0c5d4d15f7c5bfbb288
https://git.kernel.org/stable/c/27b760b81951d8d5e5c952a696af8574052b0709
https://git.kernel.org/stable/c/5c0c81a313492b83bd0c038b8839b0e04eb87563
https://git.kernel.org/stable/c/1e591ea072df7211f64542a09482b5f81cb3ad27