In the Linux kernel, the following vulnerability has been resolved:
tracing: Fix potential double free in createvarref()
In createvarref(), initvarref() is called to initialize the fields of variable reffield, which is allocated in the previous function call to createhistfield(). Function initvarref() allocates the corresponding fields such as reffield->system, but frees these fields when the function encounters an error. The caller later calls destroyhistfield() to conduct error handling, which frees the fields and the variable itself. This results in double free of the fields which are already freed in the previous function.
Fix this by storing NULL to the corresponding fields when they are freed in initvarref().
[
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@058cb6d86b9789377216c936506b346aaa1eb581",
"id": "CVE-2022-49410-018850b2",
"digest": {
"threshold": 0.9,
"line_hashes": [
"115879035695917024273943726141654413321",
"291543223238928843479634983973565376875",
"234474938306614416836184466887013210610",
"22207341190439976066222283346302997801",
"64727426251245001043786440820440365343",
"186336200445338912934924820909183888527"
]
},
"target": {
"file": "kernel/trace/trace_events_hist.c"
},
"signature_type": "Line",
"signature_version": "v1"
},
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f8b383f83cb573152c577eca1ef101e89995b72a",
"id": "CVE-2022-49410-222ed3da",
"digest": {
"function_hash": "268875901847618606128022960477289235608",
"length": 1138.0
},
"target": {
"function": "init_var_ref",
"file": "kernel/trace/trace_events_hist.c"
},
"signature_type": "Function",
"signature_version": "v1"
},
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c27f744ceefadc7bbeb14233b6abc150ced617d2",
"id": "CVE-2022-49410-3a219a2b",
"digest": {
"threshold": 0.9,
"line_hashes": [
"115879035695917024273943726141654413321",
"291543223238928843479634983973565376875",
"234474938306614416836184466887013210610",
"22207341190439976066222283346302997801",
"64727426251245001043786440820440365343",
"186336200445338912934924820909183888527"
]
},
"target": {
"file": "kernel/trace/trace_events_hist.c"
},
"signature_type": "Line",
"signature_version": "v1"
},
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4fdfb15e08598711dbf50daf56a33965232daf0e",
"id": "CVE-2022-49410-49e08e99",
"digest": {
"threshold": 0.9,
"line_hashes": [
"115879035695917024273943726141654413321",
"291543223238928843479634983973565376875",
"234474938306614416836184466887013210610",
"22207341190439976066222283346302997801",
"64727426251245001043786440820440365343",
"186336200445338912934924820909183888527"
]
},
"target": {
"file": "kernel/trace/trace_events_hist.c"
},
"signature_type": "Line",
"signature_version": "v1"
},
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4fdfb15e08598711dbf50daf56a33965232daf0e",
"id": "CVE-2022-49410-53a922cb",
"digest": {
"function_hash": "268875901847618606128022960477289235608",
"length": 1138.0
},
"target": {
"function": "init_var_ref",
"file": "kernel/trace/trace_events_hist.c"
},
"signature_type": "Function",
"signature_version": "v1"
},
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@37443b3508b8cce6832f8d25cb4550b2f7801f50",
"id": "CVE-2022-49410-750f09d1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"115879035695917024273943726141654413321",
"291543223238928843479634983973565376875",
"234474938306614416836184466887013210610",
"22207341190439976066222283346302997801",
"64727426251245001043786440820440365343",
"186336200445338912934924820909183888527"
]
},
"target": {
"file": "kernel/trace/trace_events_hist.c"
},
"signature_type": "Line",
"signature_version": "v1"
},
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@bd83ff3bbfb003832481c9bff999d12385f396ae",
"id": "CVE-2022-49410-79c25670",
"digest": {
"threshold": 0.9,
"line_hashes": [
"115879035695917024273943726141654413321",
"291543223238928843479634983973565376875",
"234474938306614416836184466887013210610",
"22207341190439976066222283346302997801",
"64727426251245001043786440820440365343",
"186336200445338912934924820909183888527"
]
},
"target": {
"file": "kernel/trace/trace_events_hist.c"
},
"signature_type": "Line",
"signature_version": "v1"
},
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c27f744ceefadc7bbeb14233b6abc150ced617d2",
"id": "CVE-2022-49410-7b4fec8d",
"digest": {
"function_hash": "268875901847618606128022960477289235608",
"length": 1138.0
},
"target": {
"function": "init_var_ref",
"file": "kernel/trace/trace_events_hist.c"
},
"signature_type": "Function",
"signature_version": "v1"
},
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@99696a2592bca641eb88cc9a80c90e591afebd0f",
"id": "CVE-2022-49410-8a0b4058",
"digest": {
"threshold": 0.9,
"line_hashes": [
"115879035695917024273943726141654413321",
"291543223238928843479634983973565376875",
"234474938306614416836184466887013210610",
"22207341190439976066222283346302997801",
"64727426251245001043786440820440365343",
"186336200445338912934924820909183888527"
]
},
"target": {
"file": "kernel/trace/trace_events_hist.c"
},
"signature_type": "Line",
"signature_version": "v1"
},
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f8b383f83cb573152c577eca1ef101e89995b72a",
"id": "CVE-2022-49410-a666d03a",
"digest": {
"threshold": 0.9,
"line_hashes": [
"115879035695917024273943726141654413321",
"291543223238928843479634983973565376875",
"234474938306614416836184466887013210610",
"22207341190439976066222283346302997801",
"64727426251245001043786440820440365343",
"114575748577314407931408623505385311507"
]
},
"target": {
"file": "kernel/trace/trace_events_hist.c"
},
"signature_type": "Line",
"signature_version": "v1"
},
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@bd83ff3bbfb003832481c9bff999d12385f396ae",
"id": "CVE-2022-49410-c5437453",
"digest": {
"function_hash": "268875901847618606128022960477289235608",
"length": 1138.0
},
"target": {
"function": "init_var_ref",
"file": "kernel/trace/trace_events_hist.c"
},
"signature_type": "Function",
"signature_version": "v1"
},
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@99696a2592bca641eb88cc9a80c90e591afebd0f",
"id": "CVE-2022-49410-cd5f30ad",
"digest": {
"function_hash": "268875901847618606128022960477289235608",
"length": 1138.0
},
"target": {
"function": "init_var_ref",
"file": "kernel/trace/trace_events_hist.c"
},
"signature_type": "Function",
"signature_version": "v1"
},
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@37443b3508b8cce6832f8d25cb4550b2f7801f50",
"id": "CVE-2022-49410-e38a3c06",
"digest": {
"function_hash": "268875901847618606128022960477289235608",
"length": 1138.0
},
"target": {
"function": "init_var_ref",
"file": "kernel/trace/trace_events_hist.c"
},
"signature_type": "Function",
"signature_version": "v1"
},
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@058cb6d86b9789377216c936506b346aaa1eb581",
"id": "CVE-2022-49410-f85720f9",
"digest": {
"function_hash": "268875901847618606128022960477289235608",
"length": 1138.0
},
"target": {
"function": "init_var_ref",
"file": "kernel/trace/trace_events_hist.c"
},
"signature_type": "Function",
"signature_version": "v1"
}
]