In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
coresight: platform: defer connection counter increment until alloc succeeds<\/p>\n
coresight_add_out_conn() increments nr_outconns before calling
\ndevm_krealloc_array() and again before devm_kmalloc(). If either
\nallocation fails, the counter is already bumped while the corresponding
\narray entry is NULL or uninitialized garbage.<\/p>\n
coresight_add_in_conn() has the same problem with nr_inconns and
\ndevm_krealloc_array().<\/p>\n
In both cases the probe returns -ENOMEM, which causes
\ncoresight_get_platform_data() to call coresight_release_platform_data()
\nfor cleanup. That function iterates up to nr_outconns (or nr_inconns)
\nentries and dereferences each pointer unconditionally, hitting the NULL
\nor garbage entry and panicking instead of failing gracefully.<\/p>\n
Fix by moving the counter increments to after all allocations succeed,
\nso the struct is always consistent on any error path.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
coresight: platform: defer connection counter increment until alloc succeeds<\/p>\n
coresight_add_out_conn() increments nr_outconns befor<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-7157","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/7157","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=7157"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=7157"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=7157"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}