Double Free Vulnerability in ubifs Package
Summary
GSD-2022-1001770: ubifs: rename_whiteout: Fix double free for whiteout_ui->data. Affects Kernel versions >= 9e0a1fff8db56eaaebb74b4a3ef65f86811c4798, < 2ad07009c459e56ebdcc089d850d664660fdb742. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The ubifs package is a file system designed for use on flash devices in the Linux kernel. It provides wear-leveling and other features specific to flash storage. This vulnerability affects versions of the Linux kernel from v4.9 to v5.15.32. The vulnerability allows an attacker to trigger a double free condition in the rename_whiteout function of the ubifs file system, potentially leading to a crash or arbitrary code execution.
Vulnerability Detail
The vulnerability occurs in the rename_whiteout function of the ubifs file system. When processing a whiteout file, the function attempts to free the memory associated with the whiteout_ui->data field. However, due to a coding error, this memory is freed twice, leading to a double free condition. An attacker can exploit this vulnerability by creating a specially crafted whiteout file and triggering the rename_whiteout function. The impact of this vulnerability can range from a denial of service (system crash) to arbitrary code execution, depending on how the double free condition is leveraged.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to apply the fix by updating the Linux kernel.
Conclusion
In conclusion, the ubifs package in the Linux kernel is vulnerable to a double free condition in the rename_whiteout function. This vulnerability can lead to a denial of service or arbitrary code execution. It is recommended to update the Linux kernel to version v5.15.33 or later to fix this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The impact of this vulnerability can range from a denial of service (system crash) to arbitrary code execution, depending on how the double free condition is leveraged.
You can use the Vulert Playground at Vulert Scanner to check if your system is affected by this vulnerability. Simply upload your package-lock.json file and Vulert will analyze it for vulnerabilities in real-time.
No, there is no known workaround for this vulnerability. It is recommended to apply the fix by updating the Linux kernel.
The fix for this vulnerability is available in the Linux kernel version v5.15.33 or later. Users can obtain the updated kernel from the official Linux kernel repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/
This vulnerability was discovered by an automated vulnerability discovery system and reported in the Open Source Vulnerability format.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
