Lucene search

K
nvd416baaa9-dc9f-4396-8d5f-8c081fb06d67NVD:CVE-2021-47483
HistoryMay 22, 2024 - 9:15 a.m.

CVE-2021-47483

2024-05-2209:15:10
416baaa9-dc9f-4396-8d5f-8c081fb06d67
web.nvd.nist.gov
1
linux kernel
double-free vulnerability
regmap
rbnode
regcache_rbtree_insert_to_block
kasan

6.4 Medium

AI Score

Confidence

Low

0.0004 Low

EPSS

Percentile

13.1%

In the Linux kernel, the following vulnerability has been resolved:

regmap: Fix possible double-free in regcache_rbtree_exit()

In regcache_rbtree_insert_to_block(), when ‘present’ realloc failed,
the ‘blk’ which is supposed to assign to ‘rbnode->block’ will be freed,
so ‘rbnode->block’ points a freed memory, in the error handling path of
regcache_rbtree_init(), ‘rbnode->block’ will be freed again in
regcache_rbtree_exit(), KASAN will report double-free as follows:

BUG: KASAN: double-free or invalid-free in kfree+0xce/0x390
Call Trace:
slab_free_freelist_hook+0x10d/0x240
kfree+0xce/0x390
regcache_rbtree_exit+0x15d/0x1a0
regcache_rbtree_init+0x224/0x2c0
regcache_init+0x88d/0x1310
__regmap_init+0x3151/0x4a80
__devm_regmap_init+0x7d/0x100
madera_spi_probe+0x10f/0x333 [madera_spi]
spi_probe+0x183/0x210
really_probe+0x285/0xc30

To fix this, moving up the assignment of rbnode->block to immediately after
the reallocation has succeeded so that the data structure stays valid even
if the second reallocation fails.

6.4 Medium

AI Score

Confidence

Low

0.0004 Low

EPSS

Percentile

13.1%