In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
of\/overlay: only treat a positive changeset id as registered<\/p>\n
of_overlay_fdt_apply() stores the idr_alloc() return value in
\novcs->id before checking it. On failure the stored id is negative,
\nfree_overlay_changeset()’s “if (ovcs->id)” check passes, idr_remove()
\nis called with a negative id and list_del() runs on ovcs->ovcs_list,
\nwhich is not initialized until after the id allocation. An allocation
\nfailure at that point dereferences NULL.<\/p>\n
Make free_overlay_changeset() treat only a strict-positive id as
\nregistered. The rest of the function already copes with a
\npartially-initialized ovcs, so the error path stays a plain
\ngoto err_free_ovcs.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
of\/overlay: only treat a positive changeset id as registered<\/p>\n
of_overlay_fdt_apply() stores the idr_alloc() return value in
\novcs->i<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-41326","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/41326","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=41326"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=41326"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=41326"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}