In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
ASoC: meson: Keep link pointers valid on realloc failure<\/p>\n
meson_card_reallocate_links() grows the DAI link and private data
\narrays with two consecutive krealloc() calls and updates the owner
\npointers only after both calls have succeeded.<\/p>\n
A successful krealloc() may move the data: it frees the old block and
\nreturns a new one. When that happens for the link array and the second
\nkrealloc() then fails, card->dai_link still points to the block that
\nkrealloc() already freed, and the error path frees the new block too.
\nThe probe error path then calls meson_card_clean_references(), which
\ndereferences card->dai_link and kfree()s it again, resulting in a
\nuse-after-free and a double free.<\/p>\n
Commit card->dai_link and card->num_links right after the first
\nkrealloc() succeeds, so the pointer always refers to a valid allocation
\nthat meson_card_clean_references() can walk and free. krealloc() with
\n__GFP_ZERO zero-initializes the added entries, so walking them on the
\nerror path is safe. With both failure paths reduced to a plain return,
\ndrop the goto labels and the error message.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
ASoC: meson: Keep link pointers valid on realloc failure<\/p>\n
meson_card_reallocate_links() grows the DAI link and private data
\narrays <\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-25898","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/25898","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=25898"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=25898"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=25898"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}