Double Free Vulnerability in rpmsg: virtio Package
Summary
GSD-2022-1003289: rpmsg: virtio: Fix possible double free in rpmsg_probe(). Affects Kernel versions >= c486682ae1e2b149add22f44cf413b3103e3ef39, < eaf37bb6b4f7c48a5adaf1be4879107daf4d6024. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The rpmsg: virtio package is a component of the Linux Kernel ecosystem. It provides support for remote processor messaging (RPMsg) over virtio transport. RPMsg is a lightweight, asynchronous communication protocol used for inter-processor communication in embedded systems. The virtio transport is a standard framework for implementing virtual devices in a hypervisor-independent manner. The rpmsg: virtio package enables communication between virtual devices and remote processors using the RPMsg protocol over the virtio transport.
Vulnerability Detail
The vulnerability identified as GSD-2022-1003289 in the rpmsg: virtio package is a possible double free issue in the rpmsg_probe() function. A double free vulnerability occurs when a program attempts to free the same memory address twice, which can lead to memory corruption and potentially allow an attacker to execute arbitrary code or cause a denial-of-service condition. The vulnerability was introduced in version v5.13 of the Linux Kernel by commit c486682ae1e2b149add22f44cf413b3103e3ef39 and was fixed in version v5.15.47 by commit eaf37bb6b4f7c48a5adaf1be4879107daf4d6024.
How To Fix
No fixed version is published for this vulnerability.
To fix this vulnerability, it is recommended to update the Linux Kernel to version v5.15.47 or later. This can be done by pulling the latest changes from the official Linux Kernel repository using the following command:
git pull https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
After updating the Kernel, recompile and reinstall it on the affected system.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the fix by updating the Linux Kernel to the recommended version.
Conclusion
The double free vulnerability in the rpmsg: virtio package can potentially lead to memory corruption and security risks. It is crucial to update the Linux Kernel to version v5.15.47 or later to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The rpmsg: virtio package is a component of the Linux Kernel ecosystem that enables communication between virtual devices and remote processors using the RPMsg protocol over the virtio transport.
RPMsg is a lightweight, asynchronous communication protocol used for inter-processor communication in embedded systems.
The virtio transport is a standard framework for implementing virtual devices in a hypervisor-independent manner.
A double free vulnerability occurs when a program attempts to free the same memory address twice, leading to memory corruption and potential security risks.
To fix this vulnerability, update the Linux Kernel to version v5.15.47 or later by pulling the latest changes from the official Linux Kernel repository.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
Follow Vulert in Google
Get more Vulert vulnerability and dependency-security updates in Google Search and AI results.