In the Linux kernel, the following vulnerability has been resolved:
selinux: fix double free of cond_list on error paths
On error path from condreadlist() and duplicatepolicydbcondlist() the condlistdestroy() gets called a second time in caller functions, resulting in NULL pointer deref. Fix this by resetting the condlistlen to 0 in condlist_destroy(), making subsequent calls a noop.
Also consistently reset the cond_list pointer to NULL after freeing.
[PM: fix line lengths in the description]
[
{
"signature_type": "Function",
"digest": {
"function_hash": "271158614185318737809265523885877644611",
"length": 675.0
},
"target": {
"file": "security/selinux/ss/conditional.c",
"function": "cond_read_list"
},
"signature_version": "v1",
"id": "CVE-2022-48740-0eee0259",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7ed9cbf7ac0d4ed86b356e1b944304ae9ee450d4"
},
{
"signature_type": "Function",
"digest": {
"function_hash": "23668602218780961121419773090136504333",
"length": 189.0
},
"target": {
"file": "security/selinux/ss/conditional.c",
"function": "cond_list_destroy"
},
"signature_version": "v1",
"id": "CVE-2022-48740-1b4e3f5d",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@186edf7e368c40d06cf727a1ad14698ea67b74ad"
},
{
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"238746905916334753048206561915799763286",
"191856447137408364423078071210843059695",
"35657816910400945853616419752874461697",
"323172306952930185540563542005395540542",
"288368520001180506248356249860786613336",
"269757860841051431279544199350949011712",
"40126304074664182362512332174844493621",
"277197832233747350864065261512538003550"
]
},
"target": {
"file": "security/selinux/ss/conditional.c"
},
"signature_version": "v1",
"id": "CVE-2022-48740-2415cbbb",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7ed9cbf7ac0d4ed86b356e1b944304ae9ee450d4"
},
{
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"238746905916334753048206561915799763286",
"191856447137408364423078071210843059695",
"35657816910400945853616419752874461697",
"323172306952930185540563542005395540542",
"288368520001180506248356249860786613336",
"269757860841051431279544199350949011712",
"40126304074664182362512332174844493621",
"277197832233747350864065261512538003550"
]
},
"target": {
"file": "security/selinux/ss/conditional.c"
},
"signature_version": "v1",
"id": "CVE-2022-48740-2632fa69",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f446089a268c8fc6908488e991d28a9b936293db"
},
{
"signature_type": "Function",
"digest": {
"function_hash": "23668602218780961121419773090136504333",
"length": 189.0
},
"target": {
"file": "security/selinux/ss/conditional.c",
"function": "cond_list_destroy"
},
"signature_version": "v1",
"id": "CVE-2022-48740-30f6da06",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f446089a268c8fc6908488e991d28a9b936293db"
},
{
"signature_type": "Function",
"digest": {
"function_hash": "271158614185318737809265523885877644611",
"length": 675.0
},
"target": {
"file": "security/selinux/ss/conditional.c",
"function": "cond_read_list"
},
"signature_version": "v1",
"id": "CVE-2022-48740-5b39bb4f",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@186edf7e368c40d06cf727a1ad14698ea67b74ad"
},
{
"signature_type": "Function",
"digest": {
"function_hash": "23668602218780961121419773090136504333",
"length": 189.0
},
"target": {
"file": "security/selinux/ss/conditional.c",
"function": "cond_list_destroy"
},
"signature_version": "v1",
"id": "CVE-2022-48740-bc66d85f",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7ed9cbf7ac0d4ed86b356e1b944304ae9ee450d4"
},
{
"signature_type": "Function",
"digest": {
"function_hash": "271158614185318737809265523885877644611",
"length": 675.0
},
"target": {
"file": "security/selinux/ss/conditional.c",
"function": "cond_read_list"
},
"signature_version": "v1",
"id": "CVE-2022-48740-cb12468f",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f446089a268c8fc6908488e991d28a9b936293db"
},
{
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"238746905916334753048206561915799763286",
"191856447137408364423078071210843059695",
"35657816910400945853616419752874461697",
"323172306952930185540563542005395540542",
"288368520001180506248356249860786613336",
"269757860841051431279544199350949011712",
"40126304074664182362512332174844493621",
"277197832233747350864065261512538003550"
]
},
"target": {
"file": "security/selinux/ss/conditional.c"
},
"signature_version": "v1",
"id": "CVE-2022-48740-d0c43275",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@186edf7e368c40d06cf727a1ad14698ea67b74ad"
}
]