In the Linux kernel, the following vulnerability has been resolved:
ubi: ubicreatevolume: Fix use-after-free when volume creation failed
There is an use-after-free problem for 'ebatbl' in ubicreate_volume()'s error handling path:
ubiebareplacetable(vol, ebatbl) vol->ebatbl = tbl outmapping: ubiebadestroytable(ebatbl) // Free 'ebatbl' outunlock: putdevice(&vol->dev) volrelease kfree(tbl->entries) // UAF
Fix it by removing redundant 'eba_tbl' releasing. Fetch a reproducer in [Link].
[
{
"signature_type": "Function",
"deprecated": false,
"target": {
"file": "drivers/mtd/ubi/vmt.c",
"function": "ubi_create_volume"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5ff2514e4fb55dcf3d88294686040ca73ea0c1a2",
"digest": {
"length": 4709.0,
"function_hash": "317985512468432433642808775180206963011"
},
"id": "CVE-2022-49388-4d7ae813"
},
{
"signature_type": "Line",
"deprecated": false,
"target": {
"file": "drivers/mtd/ubi/vmt.c"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@abb67043060f2bf4c03d7c3debb9ae980e2b6db3",
"digest": {
"line_hashes": [
"147866944009643688307198656940233824650",
"274720260499595690212016394403710496715",
"325789676298455435038649528430701287357",
"240326672968394975723886749639450539935"
],
"threshold": 0.9
},
"id": "CVE-2022-49388-505a2919"
},
{
"signature_type": "Function",
"deprecated": false,
"target": {
"file": "drivers/mtd/ubi/vmt.c",
"function": "ubi_create_volume"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@abb67043060f2bf4c03d7c3debb9ae980e2b6db3",
"digest": {
"length": 4709.0,
"function_hash": "317985512468432433642808775180206963011"
},
"id": "CVE-2022-49388-9d52f6d6"
},
{
"signature_type": "Line",
"deprecated": false,
"target": {
"file": "drivers/mtd/ubi/vmt.c"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5ff2514e4fb55dcf3d88294686040ca73ea0c1a2",
"digest": {
"line_hashes": [
"147866944009643688307198656940233824650",
"274720260499595690212016394403710496715",
"325789676298455435038649528430701287357",
"240326672968394975723886749639450539935"
],
"threshold": 0.9
},
"id": "CVE-2022-49388-e7875fff"
}
]