Double Free Vulnerability in ubifs Package
Summary
GSD-2022-1002210: ubifs: rename_whiteout: Fix double free for whiteout_ui->data. Affects Kernel versions >= 9e0a1fff8db56eaaebb74b4a3ef65f86811c4798, < 14276d38c89a170363e90b6ac0a53c3cf61b87fc. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The ubifs package is a file system designed for use on flash devices in the Linux Kernel. It provides wear-leveling and other features specific to flash storage. The package is widely used in embedded systems and devices that utilize flash memory. However, a vulnerability has been discovered in the package that could potentially lead to a double free issue.
Vulnerability Detail
The vulnerability, identified as GSD-2022-1002210, exists in the rename_whiteout function of ubifs. It is caused by a double free of the whiteout_ui->data structure. An attacker could exploit this vulnerability to execute arbitrary code or cause a denial of service by manipulating the whiteout_ui->data structure. The impact and attack plausibility of this vulnerability have not been proven yet.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to apply the fix mentioned above.
Conclusion
The double free vulnerability in the ubifs package can be mitigated by updating the Linux Kernel to version v5.4.189 or later. It is crucial to promptly apply the fix to protect systems from potential exploitation. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
ubifs is a file system designed for use on flash devices in the Linux Kernel. It provides wear-leveling and other features specific to flash storage.
The impact of this vulnerability could be the execution of arbitrary code or a denial of service attack.
To fix this vulnerability, update your Linux Kernel to version v5.4.189 or later.
There is no known workaround for this vulnerability. It is recommended to apply the fix mentioned above.
You can find more information about this vulnerability in the GSD-2022-1002210 entry of the GSD database.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
