CVE-2023-52664: linux-libc-dev - Double Free in Error Handling Logic
Summary
CVE-2023-52664: In the Linux kernel, the following vulnerability has been resolved: net: atlantic: eliminate double free in error handling logic Driver has a logic leak in ring data allocation/free, where aq_ring_free could be called mu... Affects linux versions 5.10.103-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The linux-libc-dev package is a development package that provides the necessary header files and libraries for compiling programs that use the Linux kernel interfaces. It is an essential component for building and linking applications on Debian-based systems. This package is vulnerable to a double free vulnerability in the error handling logic of the net: atlantic driver.
Vulnerability Detail
The vulnerability in the linux-libc-dev package arises from a logic leak in the ring data allocation/free process of the net: atlantic driver. Under certain conditions, if the system is under stress and encounters a memory allocation error, the aq_ring_free function could be called multiple times on the same ring. This results in a double free vulnerability. The ring pointer was incorrectly used as an indicator of failure, leading to incorrect error handling. By changing the ring allocation functions to return error codes directly, the issue is resolved, simplifying error handling and eliminating the double free vulnerability on a higher layer.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to apply the official fix by updating the linux-libc-dev package.
Conclusion
The linux-libc-dev package is vulnerable to a double free vulnerability in the net: atlantic driver. This vulnerability can be mitigated by updating the package to version 6.1.90-1 or later. It is important to promptly apply the fix to ensure the security and stability of the system. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for linux →
FAQ
The linux-libc-dev package provides the necessary header files and libraries for compiling programs that use the Linux kernel interfaces. It is an essential component for building and linking applications on Debian-based systems.
The net: atlantic driver is a network driver for the Atheros Atlantic network interface controller (NIC) family. It provides support for the network functionality of these NICs in the Linux kernel.
The double free vulnerability occurs when the aq_ring_free function is called multiple times on the same ring due to a logic leak in the ring data allocation/free process. This can happen under stress conditions and when a memory allocation error occurs.
Exploiting this vulnerability could lead to a system crash or potentially allow an attacker to execute arbitrary code with kernel privileges.
No, there is no known workaround for this vulnerability. It is recommended to apply the official fix by updating the linux-libc-dev package.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
