Double Free Vulnerability in ubifs Package
Summary
GSD-2022-1001444: ubifs: rename_whiteout: Fix double free for whiteout_ui->data. Affects Kernel versions >= 9e0a1fff8db56eaaebb74b4a3ef65f86811c4798, < b9a937f096e608b3368c1abc920d4d640ba2c94f. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The ubifs package is a file system designed for use on flash devices. It is commonly used in embedded systems and provides features such as compression, encryption, and wear leveling. The package is a part of the Linux Kernel ecosystem.
Vulnerability Detail
The vulnerability, identified as GSD-2022-1001444, exists in the rename_whiteout function of the ubifs package. It is caused by a double free issue when freeing the whiteout_ui->data structure. An attacker could potentially exploit this vulnerability to execute arbitrary code or cause a denial-of-service condition.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, if updating the kernel is not immediately feasible, it is advised to disable the use of the ubifs package or restrict access to systems utilizing it. This can help mitigate the risk of exploitation.
Conclusion
In conclusion, the ubifs package in the Linux Kernel is affected by a double free vulnerability. It is crucial to update the kernel to the latest version to address this issue. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The vulnerability could allow an attacker to execute arbitrary code or cause a denial-of-service condition.
You can use the Vulert Playground at Vulert Scanner to check if your system is affected by this vulnerability. Simply upload your package-lock.json file and the tool will provide real-time alerts for open-source vulnerabilities.
At the time of this report, there is no known exploit for this vulnerability. However, it is important to apply the recommended fix as soon as possible to prevent potential exploitation.
Yes, this vulnerability can be exploited remotely if the affected system is accessible over a network.
The recommended mitigation is to update the Linux Kernel to the latest version that includes the fix for this vulnerability. If immediate update is not possible, disabling or restricting access to systems utilizing the ubifs package can help mitigate the risk.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
