In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
orangefs: fix double-free of trailer_buf on readdir copy failure<\/p>\n
On a readdir downcall, orangefs_devreq_write_iter() frees
\nop->downcall.trailer_buf with vfree() when copy_from_iter_full() fails,
\nbut does not clear the pointer before goto Efault. The waiter in
\ndo_readdir() is then woken with a negative status and frees the same
\npointer again on its r < 0 path, causing a deterministic double-free.
\nA client holding \/dev\/pvfs2-req triggers it by sending a readdir
\ndowncall whose declared trailer_size exceeds the bytes it supplies.<\/p>\n
Clear the pointer after freeing so the readdir-side vfree() becomes a
\nno-op.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
orangefs: fix double-free of trailer_buf on readdir copy failure<\/p>\n
On a readdir downcall, orangefs_devreq_write_iter() frees
\nop->dow<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-21420","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/21420","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=21420"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=21420"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=21420"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}