Double Free Vulnerability in ubifs
Summary
GSD-2022-1002416: ubifs: rename_whiteout: Fix double free for whiteout_ui->data. Affects Kernel versions >= 9e0a1fff8db56eaaebb74b4a3ef65f86811c4798, < 8b3c7be16f3f4dfd6e15ac651484e59d3fa36274. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The ubifs package is a file system designed for use on flash devices in the Linux kernel. It provides wear-leveling and other features specific to flash storage. The vulnerability in question affects the rename_whiteout function in ubifs, which is responsible for handling whiteout files. Whiteout files are used to mark deleted files in a union file system. This vulnerability allows for a double free of the whiteout_ui->data structure, potentially leading to a use-after-free condition and subsequent code execution.
Vulnerability Detail
The vulnerability arises from a double free issue in the rename_whiteout function of ubifs. When a whiteout file is renamed, the function attempts to free the memory associated with the whiteout_ui->data structure. However, due to a programming error, this memory is freed twice, leading to a use-after-free vulnerability. An attacker who can trigger this vulnerability may be able to execute arbitrary code or cause a denial-of-service condition. The vulnerability was introduced in Linux Kernel version 4.9 and is fixed in version 4.14.276.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, users can avoid the use of whiteout files in the ubifs file system. This can be achieved by refraining from performing operations that involve renaming or deleting files in a union file system. By avoiding the use of whiteout files, the double free vulnerability can be circumvented.
Conclusion
The double free vulnerability in ubifs can be a serious security concern, potentially leading to code execution or denial-of-service attacks. It is crucial to update the Linux Kernel to the fixed version to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
Ubifs is a file system designed for use on flash devices in the Linux kernel. It provides wear-leveling and other features specific to flash storage.
A whiteout file is used in a union file system to mark deleted files. It indicates that a file has been deleted in one layer of the union file system, while still allowing it to be visible in other layers.
The double free vulnerability occurs in the rename_whiteout function of ubifs. When a whiteout file is renamed, the function attempts to free the associated memory structure. However, due to a programming error, this memory is freed twice, leading to a use-after-free vulnerability.
Exploiting this vulnerability may allow an attacker to execute arbitrary code or cause a denial-of-service condition. By triggering the double free vulnerability, an attacker can manipulate the memory allocation and potentially gain control over the system.
To mitigate this vulnerability, it is recommended to update the Linux Kernel to version 4.14.276 or later. This can be done by obtaining the latest kernel source code from the official Linux Kernel repository and compiling it according to the provided instructions.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
