In the Linux kernel, the following vulnerability has been resolved:
tracing: Fix potential double free in createvarref()
In createvarref(), initvarref() is called to initialize the fields of variable reffield, which is allocated in the previous function call to createhistfield(). Function initvarref() allocates the corresponding fields such as reffield->system, but frees these fields when the function encounters an error. The caller later calls destroyhistfield() to conduct error handling, which frees the fields and the variable itself. This results in double free of the fields which are already freed in the previous function.
Fix this by storing NULL to the corresponding fields when they are freed in initvarref().
{
"cna_assigner": "Linux",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/49xxx/CVE-2022-49410.json"
}[
{
"signature_type": "Line",
"deprecated": false,
"id": "CVE-2022-49410-018850b2",
"target": {
"file": "kernel/trace/trace_events_hist.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"115879035695917024273943726141654413321",
"291543223238928843479634983973565376875",
"234474938306614416836184466887013210610",
"22207341190439976066222283346302997801",
"64727426251245001043786440820440365343",
"186336200445338912934924820909183888527"
]
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@058cb6d86b9789377216c936506b346aaa1eb581"
},
{
"signature_type": "Function",
"deprecated": false,
"id": "CVE-2022-49410-222ed3da",
"target": {
"file": "kernel/trace/trace_events_hist.c",
"function": "init_var_ref"
},
"digest": {
"length": 1138.0,
"function_hash": "268875901847618606128022960477289235608"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f8b383f83cb573152c577eca1ef101e89995b72a"
},
{
"signature_type": "Line",
"deprecated": false,
"id": "CVE-2022-49410-3a219a2b",
"target": {
"file": "kernel/trace/trace_events_hist.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"115879035695917024273943726141654413321",
"291543223238928843479634983973565376875",
"234474938306614416836184466887013210610",
"22207341190439976066222283346302997801",
"64727426251245001043786440820440365343",
"186336200445338912934924820909183888527"
]
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c27f744ceefadc7bbeb14233b6abc150ced617d2"
},
{
"signature_type": "Line",
"deprecated": false,
"id": "CVE-2022-49410-49e08e99",
"target": {
"file": "kernel/trace/trace_events_hist.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"115879035695917024273943726141654413321",
"291543223238928843479634983973565376875",
"234474938306614416836184466887013210610",
"22207341190439976066222283346302997801",
"64727426251245001043786440820440365343",
"186336200445338912934924820909183888527"
]
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4fdfb15e08598711dbf50daf56a33965232daf0e"
},
{
"signature_type": "Function",
"deprecated": false,
"id": "CVE-2022-49410-53a922cb",
"target": {
"file": "kernel/trace/trace_events_hist.c",
"function": "init_var_ref"
},
"digest": {
"length": 1138.0,
"function_hash": "268875901847618606128022960477289235608"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4fdfb15e08598711dbf50daf56a33965232daf0e"
},
{
"signature_type": "Line",
"deprecated": false,
"id": "CVE-2022-49410-750f09d1",
"target": {
"file": "kernel/trace/trace_events_hist.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"115879035695917024273943726141654413321",
"291543223238928843479634983973565376875",
"234474938306614416836184466887013210610",
"22207341190439976066222283346302997801",
"64727426251245001043786440820440365343",
"186336200445338912934924820909183888527"
]
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@37443b3508b8cce6832f8d25cb4550b2f7801f50"
},
{
"signature_type": "Line",
"deprecated": false,
"id": "CVE-2022-49410-79c25670",
"target": {
"file": "kernel/trace/trace_events_hist.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"115879035695917024273943726141654413321",
"291543223238928843479634983973565376875",
"234474938306614416836184466887013210610",
"22207341190439976066222283346302997801",
"64727426251245001043786440820440365343",
"186336200445338912934924820909183888527"
]
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@bd83ff3bbfb003832481c9bff999d12385f396ae"
},
{
"signature_type": "Function",
"deprecated": false,
"id": "CVE-2022-49410-7b4fec8d",
"target": {
"file": "kernel/trace/trace_events_hist.c",
"function": "init_var_ref"
},
"digest": {
"length": 1138.0,
"function_hash": "268875901847618606128022960477289235608"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c27f744ceefadc7bbeb14233b6abc150ced617d2"
},
{
"signature_type": "Line",
"deprecated": false,
"id": "CVE-2022-49410-8a0b4058",
"target": {
"file": "kernel/trace/trace_events_hist.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"115879035695917024273943726141654413321",
"291543223238928843479634983973565376875",
"234474938306614416836184466887013210610",
"22207341190439976066222283346302997801",
"64727426251245001043786440820440365343",
"186336200445338912934924820909183888527"
]
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@99696a2592bca641eb88cc9a80c90e591afebd0f"
},
{
"signature_type": "Line",
"deprecated": false,
"id": "CVE-2022-49410-a666d03a",
"target": {
"file": "kernel/trace/trace_events_hist.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"115879035695917024273943726141654413321",
"291543223238928843479634983973565376875",
"234474938306614416836184466887013210610",
"22207341190439976066222283346302997801",
"64727426251245001043786440820440365343",
"114575748577314407931408623505385311507"
]
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f8b383f83cb573152c577eca1ef101e89995b72a"
},
{
"signature_type": "Function",
"deprecated": false,
"id": "CVE-2022-49410-c5437453",
"target": {
"file": "kernel/trace/trace_events_hist.c",
"function": "init_var_ref"
},
"digest": {
"length": 1138.0,
"function_hash": "268875901847618606128022960477289235608"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@bd83ff3bbfb003832481c9bff999d12385f396ae"
},
{
"signature_type": "Function",
"deprecated": false,
"id": "CVE-2022-49410-cd5f30ad",
"target": {
"file": "kernel/trace/trace_events_hist.c",
"function": "init_var_ref"
},
"digest": {
"length": 1138.0,
"function_hash": "268875901847618606128022960477289235608"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@99696a2592bca641eb88cc9a80c90e591afebd0f"
},
{
"signature_type": "Function",
"deprecated": false,
"id": "CVE-2022-49410-e38a3c06",
"target": {
"file": "kernel/trace/trace_events_hist.c",
"function": "init_var_ref"
},
"digest": {
"length": 1138.0,
"function_hash": "268875901847618606128022960477289235608"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@37443b3508b8cce6832f8d25cb4550b2f7801f50"
},
{
"signature_type": "Function",
"deprecated": false,
"id": "CVE-2022-49410-f85720f9",
"target": {
"file": "kernel/trace/trace_events_hist.c",
"function": "init_var_ref"
},
"digest": {
"length": 1138.0,
"function_hash": "268875901847618606128022960477289235608"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@058cb6d86b9789377216c936506b346aaa1eb581"
}
]
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-49410.json"