In the Linux kernel, the following vulnerability has been resolved:
ubifs: Fix memory leak in alloc_wbufs()
kmemleak reported a sequence of memory leaks, and show them as following:
unreferenced object 0xffff8881575f8400 (size 1024): comm "mount", pid 19625, jiffies 4297119604 (age 20.383s) hex dump (first 32 bytes): 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace: [<ffffffff8176cecd>] _kmalloc+0x4d/0x150 [<ffffffffa0406b2b>] ubifsmount+0x307b/0x7170 [ubifs] [<ffffffff819fa8fd>] legacygettree+0xed/0x1d0 [<ffffffff81936f2d>] vfsgettree+0x7d/0x230 [<ffffffff819b2bd4>] pathmount+0xdd4/0x17b0 [<ffffffff819b37aa>] _x64sysmount+0x1fa/0x270 [<ffffffff83c14295>] dosyscall64+0x35/0x80 [<ffffffff83e0006a>] entrySYSCALL64afterhwframe+0x46/0xb0
unreferenced object 0xffff8881798a6e00 (size 512): comm "mount", pid 19677, jiffies 4297121912 (age 37.816s) hex dump (first 32 bytes): 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk backtrace: [<ffffffff8176cecd>] _kmalloc+0x4d/0x150 [<ffffffffa0418342>] ubifswbufinit+0x52/0x480 [ubifs] [<ffffffffa0406ca5>] ubifsmount+0x31f5/0x7170 [ubifs] [<ffffffff819fa8fd>] legacygettree+0xed/0x1d0 [<ffffffff81936f2d>] vfsgettree+0x7d/0x230 [<ffffffff819b2bd4>] pathmount+0xdd4/0x17b0 [<ffffffff819b37aa>] _x64sysmount+0x1fa/0x270 [<ffffffff83c14295>] dosyscall64+0x35/0x80 [<ffffffff83e0006a>] entrySYSCALL64afterhwframe+0x46/0xb0
The problem is that the ubifswbufinit() returns an error in the loop which in the alloc_wbufs(), then the wbuf->buf and wbuf->inodes that were successfully alloced before are not freed.
Fix it by adding error hanging path in allocwbufs() which frees the memory alloced before when ubifswbuf_init() returns an error.
{
"cna_assigner": "Linux",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/53xxx/CVE-2023-53468.json"
}"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-53468.json"
[
{
"id": "CVE-2023-53468-07aa299a",
"digest": {
"threshold": 0.9,
"line_hashes": [
"244641087028315887771481220514375897537",
"39323427757958027796889048890331930754",
"54098406013202002895647671758922635130",
"251838687863695874716554387373006515171",
"152301714642935575753867931015294689492",
"294275895046071561153790334812289333711",
"15453248875893499255890295809895301171",
"296693903149433660852050494847306386404",
"273734548703801584883095260153120703600",
"303731019479261648563060537118488838491",
"238834576763013812442320089977456598113",
"179855701808827272238410414921999042551",
"46681200829947288489249460112870231752",
"139253805885345345578845103338669703265"
]
},
"signature_type": "Line",
"target": {
"file": "fs/ubifs/super.c"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4a1ff3c5d04b9079b4f768d9a71b51c4af578dd2",
"deprecated": false
},
{
"id": "CVE-2023-53468-3bea4eef",
"digest": {
"threshold": 0.9,
"line_hashes": [
"244641087028315887771481220514375897537",
"39323427757958027796889048890331930754",
"54098406013202002895647671758922635130",
"251838687863695874716554387373006515171",
"152301714642935575753867931015294689492",
"294275895046071561153790334812289333711",
"15453248875893499255890295809895301171",
"296693903149433660852050494847306386404",
"273734548703801584883095260153120703600",
"303731019479261648563060537118488838491",
"238834576763013812442320089977456598113",
"179855701808827272238410414921999042551",
"46681200829947288489249460112870231752",
"139253805885345345578845103338669703265"
]
},
"signature_type": "Line",
"target": {
"file": "fs/ubifs/super.c"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@bf50229494f0443b3f08427d7df63e5a7e2a796a",
"deprecated": false
},
{
"id": "CVE-2023-53468-5cca7f56",
"digest": {
"length": 912.0,
"function_hash": "81744272377703856887627146075765290652"
},
"signature_type": "Function",
"target": {
"file": "fs/ubifs/super.c",
"function": "alloc_wbufs"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3e29634eb56e6547272fe4e568f63421f8b3b9fa",
"deprecated": false
},
{
"id": "CVE-2023-53468-60a3a648",
"digest": {
"threshold": 0.9,
"line_hashes": [
"244641087028315887771481220514375897537",
"39323427757958027796889048890331930754",
"54098406013202002895647671758922635130",
"251838687863695874716554387373006515171",
"152301714642935575753867931015294689492",
"294275895046071561153790334812289333711",
"15453248875893499255890295809895301171",
"296693903149433660852050494847306386404",
"273734548703801584883095260153120703600",
"303731019479261648563060537118488838491",
"238834576763013812442320089977456598113",
"179855701808827272238410414921999042551",
"46681200829947288489249460112870231752",
"139253805885345345578845103338669703265"
]
},
"signature_type": "Line",
"target": {
"file": "fs/ubifs/super.c"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@26ec45f1c504e15268383019df139d7983f1e67f",
"deprecated": false
},
{
"id": "CVE-2023-53468-7dc8838e",
"digest": {
"threshold": 0.9,
"line_hashes": [
"244641087028315887771481220514375897537",
"39323427757958027796889048890331930754",
"54098406013202002895647671758922635130",
"251838687863695874716554387373006515171",
"152301714642935575753867931015294689492",
"294275895046071561153790334812289333711",
"15453248875893499255890295809895301171",
"296693903149433660852050494847306386404",
"273734548703801584883095260153120703600",
"303731019479261648563060537118488838491",
"238834576763013812442320089977456598113",
"179855701808827272238410414921999042551",
"46681200829947288489249460112870231752",
"139253805885345345578845103338669703265"
]
},
"signature_type": "Line",
"target": {
"file": "fs/ubifs/super.c"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3e29634eb56e6547272fe4e568f63421f8b3b9fa",
"deprecated": false
},
{
"id": "CVE-2023-53468-91c30e19",
"digest": {
"threshold": 0.9,
"line_hashes": [
"244641087028315887771481220514375897537",
"39323427757958027796889048890331930754",
"54098406013202002895647671758922635130",
"251838687863695874716554387373006515171",
"152301714642935575753867931015294689492",
"294275895046071561153790334812289333711",
"15453248875893499255890295809895301171",
"296693903149433660852050494847306386404",
"273734548703801584883095260153120703600",
"303731019479261648563060537118488838491",
"238834576763013812442320089977456598113",
"179855701808827272238410414921999042551",
"46681200829947288489249460112870231752",
"139253805885345345578845103338669703265"
]
},
"signature_type": "Line",
"target": {
"file": "fs/ubifs/super.c"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e11f36d3bc4d23f620754a948fe7b82b63dcb185",
"deprecated": false
},
{
"id": "CVE-2023-53468-a4eafc1a",
"digest": {
"length": 912.0,
"function_hash": "81744272377703856887627146075765290652"
},
"signature_type": "Function",
"target": {
"file": "fs/ubifs/super.c",
"function": "alloc_wbufs"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1f206002c6bc302bface871ef3f72c0bbcaa931c",
"deprecated": false
},
{
"id": "CVE-2023-53468-b7dd9773",
"digest": {
"length": 912.0,
"function_hash": "81744272377703856887627146075765290652"
},
"signature_type": "Function",
"target": {
"file": "fs/ubifs/super.c",
"function": "alloc_wbufs"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@bf50229494f0443b3f08427d7df63e5a7e2a796a",
"deprecated": false
},
{
"id": "CVE-2023-53468-d56e4fc7",
"digest": {
"length": 912.0,
"function_hash": "81744272377703856887627146075765290652"
},
"signature_type": "Function",
"target": {
"file": "fs/ubifs/super.c",
"function": "alloc_wbufs"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@26ec45f1c504e15268383019df139d7983f1e67f",
"deprecated": false
},
{
"id": "CVE-2023-53468-e0d571d3",
"digest": {
"length": 912.0,
"function_hash": "81744272377703856887627146075765290652"
},
"signature_type": "Function",
"target": {
"file": "fs/ubifs/super.c",
"function": "alloc_wbufs"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4a1ff3c5d04b9079b4f768d9a71b51c4af578dd2",
"deprecated": false
},
{
"id": "CVE-2023-53468-e53d96a6",
"digest": {
"threshold": 0.9,
"line_hashes": [
"244641087028315887771481220514375897537",
"39323427757958027796889048890331930754",
"54098406013202002895647671758922635130",
"251838687863695874716554387373006515171",
"152301714642935575753867931015294689492",
"294275895046071561153790334812289333711",
"15453248875893499255890295809895301171",
"296693903149433660852050494847306386404",
"273734548703801584883095260153120703600",
"303731019479261648563060537118488838491",
"238834576763013812442320089977456598113",
"179855701808827272238410414921999042551",
"46681200829947288489249460112870231752",
"139253805885345345578845103338669703265"
]
},
"signature_type": "Line",
"target": {
"file": "fs/ubifs/super.c"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1f206002c6bc302bface871ef3f72c0bbcaa931c",
"deprecated": false
},
{
"id": "CVE-2023-53468-f109369d",
"digest": {
"length": 912.0,
"function_hash": "81744272377703856887627146075765290652"
},
"signature_type": "Function",
"target": {
"file": "fs/ubifs/super.c",
"function": "alloc_wbufs"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e11f36d3bc4d23f620754a948fe7b82b63dcb185",
"deprecated": false
}
]