Use-after-free vulnerability in ubi_create_volume function in Kernel
Summary
GSD-2022-1003967: ubi: ubi_create_volume: Fix use-after-free when volume creation failed. Affects Kernel versions >= 493cfaeaa0c9bc0c79ce5751193d49fdac9aaaec, < 25ff1e3a1351c0d936dd1ac2f9e58231ea1510c9. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Kernel is a crucial component of the Linux operating system that provides core functionality and acts as an interface between hardware and software. It manages system resources, facilitates communication between different software components, and ensures the overall stability and security of the system. The ubi_create_volume function is responsible for creating volumes in the UBI (Unsorted Block Images) subsystem, which is used for managing flash memory devices. This vulnerability specifically affects the ubi_create_volume function in the Kernel.
Vulnerability Detail
The use-after-free vulnerability in the ubi_create_volume function occurs when volume creation fails. This vulnerability allows an attacker to exploit a freed memory region, leading to potential memory corruption or arbitrary code execution. The vulnerability was introduced in version v4.12 of the Linux Kernel by commit 493cfaeaa0c9bc0c79ce5751193d49fdac9aaaec and is fixed in version v4.14.283 by commit 25ff1e3a1351c0d936dd1ac2f9e58231ea1510c9. The impact and attack plausibility of this vulnerability have not been proven yet.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
No specific workaround has been mentioned for this vulnerability.
Conclusion
The use-after-free vulnerability in the ubi_create_volume function of the Kernel can potentially lead to memory corruption or arbitrary code execution. It is recommended to update the Kernel to version v4.14.283 or later to mitigate this vulnerability. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The Kernel is a fundamental component of the Linux operating system that manages system resources and facilitates communication between software and hardware.
The ubi_create_volume function is responsible for creating volumes in the UBI subsystem, which is used for managing flash memory devices.
A use-after-free vulnerability occurs when a program continues to use a memory region after it has been freed, potentially leading to memory corruption or arbitrary code execution.
You can use the Vulert playground (https://vulert.com/scanner) to check if your system is affected by this vulnerability. Simply upload your manifest file (e.g., package-lock.json) and Vulert will analyze it for open-source vulnerabilities in real-time.
No known exploit for this vulnerability has been reported at this time.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
