Lucene search

K
vulnrichmentLinuxVULNRICHMENT:CVE-2021-47483
HistoryMay 22, 2024 - 8:19 a.m.

CVE-2021-47483 regmap: Fix possible double-free in regcache_rbtree_exit()

2024-05-2208:19:34
Linux
github.com
1
linux kernel
regmap
vulnerability
double-free
memory error
kasan

AI Score

6.7

Confidence

Low

SSVC

Exploitation

none

Automatable

no

Technical Impact

partial

In the Linux kernel, the following vulnerability has been resolved:

regmap: Fix possible double-free in regcache_rbtree_exit()

In regcache_rbtree_insert_to_block(), when ‘present’ realloc failed,
the ‘blk’ which is supposed to assign to ‘rbnode->block’ will be freed,
so ‘rbnode->block’ points a freed memory, in the error handling path of
regcache_rbtree_init(), ‘rbnode->block’ will be freed again in
regcache_rbtree_exit(), KASAN will report double-free as follows:

BUG: KASAN: double-free or invalid-free in kfree+0xce/0x390
Call Trace:
slab_free_freelist_hook+0x10d/0x240
kfree+0xce/0x390
regcache_rbtree_exit+0x15d/0x1a0
regcache_rbtree_init+0x224/0x2c0
regcache_init+0x88d/0x1310
__regmap_init+0x3151/0x4a80
__devm_regmap_init+0x7d/0x100
madera_spi_probe+0x10f/0x333 [madera_spi]
spi_probe+0x183/0x210
really_probe+0x285/0xc30

To fix this, moving up the assignment of rbnode->block to immediately after
the reallocation has succeeded so that the data structure stays valid even
if the second reallocation fails.

AI Score

6.7

Confidence

Low

SSVC

Exploitation

none

Automatable

no

Technical Impact

partial