Double Free Vulnerability in ubifs
Summary
GSD-2022-1002329: ubifs: rename_whiteout: Fix double free for whiteout_ui->data. Affects Kernel versions >= 9e0a1fff8db56eaaebb74b4a3ef65f86811c4798, < 2b3236ecf96db7af5836e1366ce39ace8ce832fa. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The ubifs package is a file system designed for use on flash devices in the Linux Kernel. It provides wear-leveling and other optimizations to improve performance and reliability. The package is widely used in embedded systems and other devices that utilize flash storage. However, a vulnerability has been discovered in the rename_whiteout function of ubifs, which can lead to a double free issue.
Vulnerability Detail
The vulnerability in ubifs arises from a double free issue in the rename_whiteout function. When processing a whiteout file, the function attempts to free the memory associated with the whiteout_ui->data structure. However, due to a programming error, this memory is freed twice, leading to a use-after-free vulnerability. An attacker could potentially exploit this vulnerability to execute arbitrary code or cause a denial-of-service condition.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the patch provided by the Linux Kernel developers to mitigate the risk.
Conclusion
The double free vulnerability in ubifs can have severe consequences, including arbitrary code execution and denial-of-service. It is crucial to update the Linux Kernel to the latest stable version to ensure the vulnerability is patched. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
ubifs is a file system designed for use on flash devices in the Linux Kernel. It provides wear-leveling and other optimizations to improve performance and reliability.
The vulnerability can lead to a use-after-free issue, which could be exploited by an attacker to execute arbitrary code or cause a denial-of-service condition.
To fix this vulnerability, update the Linux Kernel to version v4.19.238 or later, which includes the necessary patch.
No, there is no known workaround for this vulnerability. It is crucial to apply the patch provided by the Linux Kernel developers.
For more details about this vulnerability, refer to the provided references link.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
