linux-cve-announce - CVE-2021-47483: regmap: Fix possible double-free in regcache_rbtree

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <2024052238-CVE-2021-47483-8306@gregkh>
Date: Wed, 22 May 2024 10:19:43 +0200
From: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
To: linux-cve-announce@...r.kernel.org
Cc: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
Subject: CVE-2021-47483: regmap: Fix possible double-free in regcache_rbtree_exit()

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

regmap: Fix possible double-free in regcache_rbtree_exit()

In regcache_rbtree_insert_to_block(), when 'present' realloc failed,
the 'blk' which is supposed to assign to 'rbnode->block' will be freed,
so 'rbnode->block' points a freed memory, in the error handling path of
regcache_rbtree_init(), 'rbnode->block' will be freed again in
regcache_rbtree_exit(), KASAN will report double-free as follows:

BUG: KASAN: double-free or invalid-free in kfree+0xce/0x390
Call Trace:
 slab_free_freelist_hook+0x10d/0x240
 kfree+0xce/0x390
 regcache_rbtree_exit+0x15d/0x1a0
 regcache_rbtree_init+0x224/0x2c0
 regcache_init+0x88d/0x1310
 __regmap_init+0x3151/0x4a80
 __devm_regmap_init+0x7d/0x100
 madera_spi_probe+0x10f/0x333 [madera_spi]
 spi_probe+0x183/0x210
 really_probe+0x285/0xc30

To fix this, moving up the assignment of rbnode->block to immediately after
the reallocation has succeeded so that the data structure stays valid even
if the second reallocation fails.

The Linux kernel CVE team has assigned CVE-2021-47483 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 3.12 with commit 3f4ff561bc88 and fixed in 4.4.291 with commit e72dce9afbdb
	Issue introduced in 3.12 with commit 3f4ff561bc88 and fixed in 4.9.289 with commit fc081477b47d
	Issue introduced in 3.12 with commit 3f4ff561bc88 and fixed in 4.14.254 with commit 758ced2c3878
	Issue introduced in 3.12 with commit 3f4ff561bc88 and fixed in 4.19.215 with commit 3dae1a4eced3
	Issue introduced in 3.12 with commit 3f4ff561bc88 and fixed in 5.4.157 with commit 1cead23c1c0b
	Issue introduced in 3.12 with commit 3f4ff561bc88 and fixed in 5.10.77 with commit 36e911a16b37
	Issue introduced in 3.12 with commit 3f4ff561bc88 and fixed in 5.14.16 with commit 50cc1462a668
	Issue introduced in 3.12 with commit 3f4ff561bc88 and fixed in 5.15 with commit 55e6d8037805

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2021-47483
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	drivers/base/regmap/regcache-rbtree.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/e72dce9afbdbfa70d9b44f5908a50ff6c4858999
	https://git.kernel.org/stable/c/fc081477b47dfc3a6cb50a96087fc29674013fc2
	https://git.kernel.org/stable/c/758ced2c3878ff789801e6fee808e185c5cf08d6
	https://git.kernel.org/stable/c/3dae1a4eced3ee733d7222e69b8a55caf2d61091
	https://git.kernel.org/stable/c/1cead23c1c0bc766dacb900a3b0269f651ad596f
	https://git.kernel.org/stable/c/36e911a16b377bde0ad91a8c679069d0d310b1a6
	https://git.kernel.org/stable/c/50cc1462a668dc62949a1127388bc3af785ce047
	https://git.kernel.org/stable/c/55e6d8037805b3400096d621091dfbf713f97e83