In the Linux kernel, the following vulnerability has been resolved:
net/mlx5e: fix a potential double-free in fsanycreate_groups
When kcalloc() for ft->g succeeds but kvzalloc() for in fails, fsanycreategroups() will free ft->g. However, its caller fsanycreatetable() will free ft->g again through calling mlx5edestroyflowtable(), which will lead to a double-free. Fix this by setting ft->g to NULL in fsanycreategroups().
[
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2897c981ee63e1be5e530b1042484626a10b26d8",
"id": "CVE-2023-52667-26f9fd37",
"deprecated": false,
"target": {
"function": "fs_any_create_groups",
"file": "drivers/net/ethernet/mellanox/mlx5/core/en/fs_tt_redirect.c"
},
"signature_version": "v1",
"digest": {
"length": 1400.0,
"function_hash": "147376023913345920487991398294575208870"
},
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@65a4ade8a6d205979292e88beeb6a626ddbd4779",
"id": "CVE-2023-52667-2fd4b28d",
"deprecated": false,
"target": {
"function": "fs_any_create_groups",
"file": "drivers/net/ethernet/mellanox/mlx5/core/en/fs_tt_redirect.c"
},
"signature_version": "v1",
"digest": {
"length": 1400.0,
"function_hash": "147376023913345920487991398294575208870"
},
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b2fa86b2aceb4bc9ada51cea90f61546d7512cbe",
"id": "CVE-2023-52667-342e3a93",
"deprecated": false,
"target": {
"file": "drivers/net/ethernet/mellanox/mlx5/core/en/fs_tt_redirect.c"
},
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"114142935746864700313545165354985857818",
"66659813777981439787663763053748158057",
"103115150135373893871965405999435675891",
"308514390217116525482697362280067476999"
]
},
"signature_type": "Line"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b2fa86b2aceb4bc9ada51cea90f61546d7512cbe",
"id": "CVE-2023-52667-4e634bf3",
"deprecated": false,
"target": {
"function": "fs_any_create_groups",
"file": "drivers/net/ethernet/mellanox/mlx5/core/en/fs_tt_redirect.c"
},
"signature_version": "v1",
"digest": {
"length": 1400.0,
"function_hash": "147376023913345920487991398294575208870"
},
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2897c981ee63e1be5e530b1042484626a10b26d8",
"id": "CVE-2023-52667-83b89748",
"deprecated": false,
"target": {
"file": "drivers/net/ethernet/mellanox/mlx5/core/en/fs_tt_redirect.c"
},
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"114142935746864700313545165354985857818",
"66659813777981439787663763053748158057",
"103115150135373893871965405999435675891",
"308514390217116525482697362280067476999"
]
},
"signature_type": "Line"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@aef855df7e1bbd5aa4484851561211500b22707e",
"id": "CVE-2023-52667-9b34e7d8",
"deprecated": false,
"target": {
"file": "drivers/net/ethernet/mellanox/mlx5/core/en/fs_tt_redirect.c"
},
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"114142935746864700313545165354985857818",
"66659813777981439787663763053748158057",
"103115150135373893871965405999435675891",
"308514390217116525482697362280067476999"
]
},
"signature_type": "Line"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@72a729868592752b5a294d27453da264106983b1",
"id": "CVE-2023-52667-a8e227a3",
"deprecated": false,
"target": {
"file": "drivers/net/ethernet/mellanox/mlx5/core/en/fs_tt_redirect.c"
},
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"114142935746864700313545165354985857818",
"66659813777981439787663763053748158057",
"103115150135373893871965405999435675891",
"308514390217116525482697362280067476999"
]
},
"signature_type": "Line"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@72a729868592752b5a294d27453da264106983b1",
"id": "CVE-2023-52667-ab357176",
"deprecated": false,
"target": {
"function": "fs_any_create_groups",
"file": "drivers/net/ethernet/mellanox/mlx5/core/en/fs_tt_redirect.c"
},
"signature_version": "v1",
"digest": {
"length": 1400.0,
"function_hash": "147376023913345920487991398294575208870"
},
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@65a4ade8a6d205979292e88beeb6a626ddbd4779",
"id": "CVE-2023-52667-b35dc365",
"deprecated": false,
"target": {
"file": "drivers/net/ethernet/mellanox/mlx5/core/en/fs_tt_redirect.c"
},
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"114142935746864700313545165354985857818",
"66659813777981439787663763053748158057",
"103115150135373893871965405999435675891",
"308514390217116525482697362280067476999"
]
},
"signature_type": "Line"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@aef855df7e1bbd5aa4484851561211500b22707e",
"id": "CVE-2023-52667-db716bba",
"deprecated": false,
"target": {
"function": "fs_any_create_groups",
"file": "drivers/net/ethernet/mellanox/mlx5/core/en/fs_tt_redirect.c"
},
"signature_version": "v1",
"digest": {
"length": 1400.0,
"function_hash": "147376023913345920487991398294575208870"
},
"signature_type": "Function"
}
]