In the Linux kernel, the following vulnerability has been resolved:
jffs2: fix memory leak in jffs2scanmedium
If an error is returned in jffs2scaneraseblock() and some memory has been added to the jffs2_summary *s, we can observe the following kmemleak report:
unreferenced object 0xffff88812b889c40 (size 64): comm "mount", pid 692, jiffies 4294838325 (age 34.288s) hex dump (first 32 bytes): 40 48 b5 14 81 88 ff ff 01 e0 31 00 00 00 50 00 @H........1...P. 00 00 01 00 00 00 01 00 00 00 02 00 00 00 09 08 ................ backtrace: [<ffffffffae93a3a3>] _kmalloc+0x613/0x910 [<ffffffffaf423b9c>] jffs2sumadddirentmem+0x5c/0xa0 [<ffffffffb0f3afa8>] jffs2scanmedium.cold+0x36e5/0x4794 [<ffffffffb0f3dbe1>] jffs2domountfs.cold+0xa7/0x2267 [<ffffffffaf40acf3>] jffs2dofillsuper+0x383/0xc30 [<ffffffffaf40c00a>] jffs2fillsuper+0x2ea/0x4c0 [<ffffffffb0315d64>] mtdgetsb+0x254/0x400 [<ffffffffb0315f5f>] mtdgetsbbynr+0x4f/0xd0 [<ffffffffb0316478>] gettreemtd+0x498/0x840 [<ffffffffaf40bd15>] jffs2gettree+0x25/0x30 [<ffffffffae9f358d>] vfsgettree+0x8d/0x2e0 [<ffffffffaea7a98f>] pathmount+0x50f/0x1e50 [<ffffffffaea7c3d7>] domount+0x107/0x130 [<ffffffffaea7c5c5>] _sesysmount+0x1c5/0x2f0 [<ffffffffaea7c917>] _x64sysmount+0xc7/0x160 [<ffffffffb10142f5>] dosyscall64+0x45/0x70 unreferenced object 0xffff888114b54840 (size 32): comm "mount", pid 692, jiffies 4294838325 (age 34.288s) hex dump (first 32 bytes): c0 75 b5 14 81 88 ff ff 02 e0 02 00 00 00 02 00 .u.............. 00 00 84 00 00 00 44 00 00 00 6b 6b 6b 6b 6b a5 ......D...kkkkk. backtrace: [<ffffffffae93be24>] kmemcachealloctrace+0x584/0x880 [<ffffffffaf423b04>] jffs2sumaddinodemem+0x54/0x90 [<ffffffffb0f3bd44>] jffs2scanmedium.cold+0x4481/0x4794 [...] unreferenced object 0xffff888114b57280 (size 32): comm "mount", pid 692, jiffies 4294838393 (age 34.357s) hex dump (first 32 bytes): 10 d5 6c 11 81 88 ff ff 08 e0 05 00 00 00 01 00 ..l............. 00 00 38 02 00 00 28 00 00 00 6b 6b 6b 6b 6b a5 ..8...(...kkkkk. backtrace: [<ffffffffae93be24>] kmemcachealloctrace+0x584/0x880 [<ffffffffaf423c34>] jffs2sumaddxattrmem+0x54/0x90 [<ffffffffb0f3a24f>] jffs2scanmedium.cold+0x298c/0x4794 [...] unreferenced object 0xffff8881116cd510 (size 16): comm "mount", pid 692, jiffies 4294838395 (age 34.355s) hex dump (first 16 bytes): 00 00 00 00 00 00 00 00 09 e0 60 02 00 00 6b a5 ..........`...k. backtrace: [<ffffffffae93be24>] kmemcachealloctrace+0x584/0x880 [<ffffffffaf423cc4>] jffs2sumaddxrefmem+0x54/0x90 [<ffffffffb0f3b2e3>] jffs2scanmedium.cold+0x3a20/0x4794
Therefore, we should call jffs2sumresetcollected(s) on exit to release the memory added in s. In addition, a new tag "outbuf" is added to prevent the NULL pointer reference caused by s being NULL. (thanks to Zhang Yi for this analysis)
[
{
"id": "CVE-2022-49276-3250ae7b",
"signature_type": "Line",
"digest": {
"line_hashes": [
"153464597441923406419680428715077515000",
"229889088010702439420756000523214427268",
"213412984459532907720588903229668266526",
"222951149248051650872277508180271926904",
"288935691362560993322499239611312712085",
"263780800247472698427424373835965891092",
"157785618284470394222266246666663414983",
"125679630873563630577750755345161153316",
"277685241638195296383628214868946495569",
"274381257837682806587761176924971355597",
"251594940104903872317989603597294843511",
"301073481680685410987365031638885120492",
"274974752555906807377735467849744652238",
"78902378854795477878137773970386012410",
"241213022998270807467384281661254723753"
],
"threshold": 0.9
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b26bbc0c122cad038831f226a4cb4de702225e16",
"target": {
"file": "fs/jffs2/scan.c"
}
},
{
"id": "CVE-2022-49276-455f9470",
"signature_type": "Function",
"digest": {
"length": 4378.0,
"function_hash": "125137014418204872010754489010407904219"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b26bbc0c122cad038831f226a4cb4de702225e16",
"target": {
"function": "jffs2_scan_medium",
"file": "fs/jffs2/scan.c"
}
},
{
"id": "CVE-2022-49276-53666ae8",
"signature_type": "Line",
"digest": {
"line_hashes": [
"153464597441923406419680428715077515000",
"229889088010702439420756000523214427268",
"213412984459532907720588903229668266526",
"222951149248051650872277508180271926904",
"288935691362560993322499239611312712085",
"263780800247472698427424373835965891092",
"157785618284470394222266246666663414983",
"125679630873563630577750755345161153316",
"277685241638195296383628214868946495569",
"274381257837682806587761176924971355597",
"251594940104903872317989603597294843511",
"301073481680685410987365031638885120492",
"274974752555906807377735467849744652238",
"78902378854795477878137773970386012410",
"241213022998270807467384281661254723753"
],
"threshold": 0.9
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@455f4a23490bfcbedc8e5c245c463a59b19e5ddd",
"target": {
"file": "fs/jffs2/scan.c"
}
},
{
"id": "CVE-2022-49276-5fc58328",
"signature_type": "Function",
"digest": {
"length": 4378.0,
"function_hash": "125137014418204872010754489010407904219"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@52ba0ab4f0a606f02a6163493378989faa1ec10a",
"target": {
"function": "jffs2_scan_medium",
"file": "fs/jffs2/scan.c"
}
},
{
"id": "CVE-2022-49276-66c17b36",
"signature_type": "Line",
"digest": {
"line_hashes": [
"153464597441923406419680428715077515000",
"229889088010702439420756000523214427268",
"213412984459532907720588903229668266526",
"222951149248051650872277508180271926904",
"288935691362560993322499239611312712085",
"263780800247472698427424373835965891092",
"157785618284470394222266246666663414983",
"125679630873563630577750755345161153316",
"277685241638195296383628214868946495569",
"274381257837682806587761176924971355597",
"251594940104903872317989603597294843511",
"301073481680685410987365031638885120492",
"274974752555906807377735467849744652238",
"78902378854795477878137773970386012410",
"241213022998270807467384281661254723753"
],
"threshold": 0.9
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9b0c69182f09b70779817af4dcf89780955d5c4c",
"target": {
"file": "fs/jffs2/scan.c"
}
},
{
"id": "CVE-2022-49276-7c708f88",
"signature_type": "Line",
"digest": {
"line_hashes": [
"153464597441923406419680428715077515000",
"229889088010702439420756000523214427268",
"213412984459532907720588903229668266526",
"222951149248051650872277508180271926904",
"288935691362560993322499239611312712085",
"263780800247472698427424373835965891092",
"157785618284470394222266246666663414983",
"125679630873563630577750755345161153316",
"277685241638195296383628214868946495569",
"274381257837682806587761176924971355597",
"251594940104903872317989603597294843511",
"301073481680685410987365031638885120492",
"274974752555906807377735467849744652238",
"78902378854795477878137773970386012410",
"241213022998270807467384281661254723753"
],
"threshold": 0.9
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@51dbb5e36d59f62e34d462b801c1068248149cfe",
"target": {
"file": "fs/jffs2/scan.c"
}
},
{
"id": "CVE-2022-49276-8e8ae658",
"signature_type": "Function",
"digest": {
"length": 4349.0,
"function_hash": "206996923512617747262636309759834106230"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9b0c69182f09b70779817af4dcf89780955d5c4c",
"target": {
"function": "jffs2_scan_medium",
"file": "fs/jffs2/scan.c"
}
},
{
"id": "CVE-2022-49276-a24cc24a",
"signature_type": "Line",
"digest": {
"line_hashes": [
"153464597441923406419680428715077515000",
"229889088010702439420756000523214427268",
"213412984459532907720588903229668266526",
"222951149248051650872277508180271926904",
"288935691362560993322499239611312712085",
"263780800247472698427424373835965891092",
"157785618284470394222266246666663414983",
"125679630873563630577750755345161153316",
"277685241638195296383628214868946495569",
"274381257837682806587761176924971355597",
"251594940104903872317989603597294843511",
"301073481680685410987365031638885120492",
"274974752555906807377735467849744652238",
"78902378854795477878137773970386012410",
"241213022998270807467384281661254723753"
],
"threshold": 0.9
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@52ba0ab4f0a606f02a6163493378989faa1ec10a",
"target": {
"file": "fs/jffs2/scan.c"
}
},
{
"id": "CVE-2022-49276-a3566027",
"signature_type": "Function",
"digest": {
"length": 4349.0,
"function_hash": "206996923512617747262636309759834106230"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b36bccb04e14cc0c1e2d0e92d477fe220314fad6",
"target": {
"function": "jffs2_scan_medium",
"file": "fs/jffs2/scan.c"
}
},
{
"id": "CVE-2022-49276-a3c97730",
"signature_type": "Function",
"digest": {
"length": 4349.0,
"function_hash": "206996923512617747262636309759834106230"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e711913463af916d777a4873068f415f1fe2ad33",
"target": {
"function": "jffs2_scan_medium",
"file": "fs/jffs2/scan.c"
}
},
{
"id": "CVE-2022-49276-a5249057",
"signature_type": "Line",
"digest": {
"line_hashes": [
"153464597441923406419680428715077515000",
"229889088010702439420756000523214427268",
"213412984459532907720588903229668266526",
"222951149248051650872277508180271926904",
"288935691362560993322499239611312712085",
"263780800247472698427424373835965891092",
"157785618284470394222266246666663414983",
"125679630873563630577750755345161153316",
"277685241638195296383628214868946495569",
"274381257837682806587761176924971355597",
"251594940104903872317989603597294843511",
"301073481680685410987365031638885120492",
"274974752555906807377735467849744652238",
"78902378854795477878137773970386012410",
"241213022998270807467384281661254723753"
],
"threshold": 0.9
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9cdd3128874f5fe759e2c4e1360ab7fb96a8d1df",
"target": {
"file": "fs/jffs2/scan.c"
}
},
{
"id": "CVE-2022-49276-b7562160",
"signature_type": "Line",
"digest": {
"line_hashes": [
"153464597441923406419680428715077515000",
"229889088010702439420756000523214427268",
"213412984459532907720588903229668266526",
"222951149248051650872277508180271926904",
"288935691362560993322499239611312712085",
"263780800247472698427424373835965891092",
"157785618284470394222266246666663414983",
"125679630873563630577750755345161153316",
"277685241638195296383628214868946495569",
"274381257837682806587761176924971355597",
"251594940104903872317989603597294843511",
"301073481680685410987365031638885120492",
"274974752555906807377735467849744652238",
"78902378854795477878137773970386012410",
"241213022998270807467384281661254723753"
],
"threshold": 0.9
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@82462324bf35b6b553400af1c1aa265069cee28f",
"target": {
"file": "fs/jffs2/scan.c"
}
},
{
"id": "CVE-2022-49276-d0614cc2",
"signature_type": "Function",
"digest": {
"length": 4349.0,
"function_hash": "206996923512617747262636309759834106230"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@455f4a23490bfcbedc8e5c245c463a59b19e5ddd",
"target": {
"function": "jffs2_scan_medium",
"file": "fs/jffs2/scan.c"
}
},
{
"id": "CVE-2022-49276-d0fbfe0c",
"signature_type": "Function",
"digest": {
"length": 4378.0,
"function_hash": "125137014418204872010754489010407904219"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@82462324bf35b6b553400af1c1aa265069cee28f",
"target": {
"function": "jffs2_scan_medium",
"file": "fs/jffs2/scan.c"
}
},
{
"id": "CVE-2022-49276-d82b699e",
"signature_type": "Function",
"digest": {
"length": 4378.0,
"function_hash": "125137014418204872010754489010407904219"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@51dbb5e36d59f62e34d462b801c1068248149cfe",
"target": {
"function": "jffs2_scan_medium",
"file": "fs/jffs2/scan.c"
}
},
{
"id": "CVE-2022-49276-eafbae2b",
"signature_type": "Line",
"digest": {
"line_hashes": [
"153464597441923406419680428715077515000",
"229889088010702439420756000523214427268",
"213412984459532907720588903229668266526",
"222951149248051650872277508180271926904",
"288935691362560993322499239611312712085",
"263780800247472698427424373835965891092",
"157785618284470394222266246666663414983",
"125679630873563630577750755345161153316",
"277685241638195296383628214868946495569",
"274381257837682806587761176924971355597",
"251594940104903872317989603597294843511",
"301073481680685410987365031638885120492",
"274974752555906807377735467849744652238",
"78902378854795477878137773970386012410",
"241213022998270807467384281661254723753"
],
"threshold": 0.9
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b36bccb04e14cc0c1e2d0e92d477fe220314fad6",
"target": {
"file": "fs/jffs2/scan.c"
}
},
{
"id": "CVE-2022-49276-f78304b4",
"signature_type": "Line",
"digest": {
"line_hashes": [
"153464597441923406419680428715077515000",
"229889088010702439420756000523214427268",
"213412984459532907720588903229668266526",
"222951149248051650872277508180271926904",
"288935691362560993322499239611312712085",
"263780800247472698427424373835965891092",
"157785618284470394222266246666663414983",
"125679630873563630577750755345161153316",
"277685241638195296383628214868946495569",
"274381257837682806587761176924971355597",
"251594940104903872317989603597294843511",
"301073481680685410987365031638885120492",
"274974752555906807377735467849744652238",
"78902378854795477878137773970386012410",
"241213022998270807467384281661254723753"
],
"threshold": 0.9
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e711913463af916d777a4873068f415f1fe2ad33",
"target": {
"file": "fs/jffs2/scan.c"
}
},
{
"id": "CVE-2022-49276-f9278f1f",
"signature_type": "Function",
"digest": {
"length": 4378.0,
"function_hash": "125137014418204872010754489010407904219"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9cdd3128874f5fe759e2c4e1360ab7fb96a8d1df",
"target": {
"function": "jffs2_scan_medium",
"file": "fs/jffs2/scan.c"
}
}
]