Lucene search

K
ubuntucveUbuntu.comUB:CVE-2021-47483
HistoryMay 22, 2024 - 12:00 a.m.

CVE-2021-47483

2024-05-2200:00:00
ubuntu.com
ubuntu.com
3
linux kernel
regmap
double-free vulnerability
regcache_rbtree_exit
kasan

6.5 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

13.1%

In the Linux kernel, the following vulnerability has been resolved: regmap:
Fix possible double-free in regcache_rbtree_exit() In
regcache_rbtree_insert_to_block(), when ‘present’ realloc failed, the ‘blk’
which is supposed to assign to ‘rbnode->block’ will be freed, so
‘rbnode->block’ points a freed memory, in the error handling path of
regcache_rbtree_init(), ‘rbnode->block’ will be freed again in
regcache_rbtree_exit(), KASAN will report double-free as follows: BUG:
KASAN: double-free or invalid-free in kfree+0xce/0x390 Call Trace:
slab_free_freelist_hook+0x10d/0x240 kfree+0xce/0x390
regcache_rbtree_exit+0x15d/0x1a0 regcache_rbtree_init+0x224/0x2c0
regcache_init+0x88d/0x1310 __regmap_init+0x3151/0x4a80
__devm_regmap_init+0x7d/0x100 madera_spi_probe+0x10f/0x333 [madera_spi]
spi_probe+0x183/0x210 really_probe+0x285/0xc30 To fix this, moving up the
assignment of rbnode->block to immediately after the reallocation has
succeeded so that the data structure stays valid even if the second
reallocation fails.

6.5 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

13.1%