In the Linux kernel, the following vulnerability has been resolved:
net: batman-adv: fix error handling
Syzbot reported ODEBUG warning in batadv_nc_mesh_free(). The problem was in wrong error handling in batadv_mesh_init().
Before this patch batadv_mesh_init() was calling batadv_mesh_free() in case of any batadv_*_init() calls failure. This approach may work well, when there is some kind of indicator, which can tell which parts of batadv are initialized; but there isn't any.
All written above lead to cleaning up uninitialized fields. Even if we hide ODEBUG warning by initializing bat_priv->nc.work, syzbot was able to hit GPF in batadv_nc_purge_paths(), because hash pointer in still NULL. [1]
To fix these bugs we can unwind batadv_*_init() calls one by one. It is good approach for 2 reasons: 1) It fixes bugs on error handling path 2) It improves the performance, since we won't call unneeded batadv_*_free() functions.
So, this patch makes all batadv_*_init() clean up all allocated memory before returning with an error to no call correspoing batadv_*_free() and open-codes batadv_mesh_free() with proper order to avoid touching uninitialized fields.
CVSS Details
- CVSS 3.1 Base Score: 5.3
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade linux | Jul 30, 2024 | May 22, 2024 |
| Suse | — | Upgrade kernel-azure-vdsoUpgrade kernel-obs-qaUpgrade kernel-azure-extraUpgrade kernel-rt-livepatchUpgrade kernel-source-azureUpgrade kernel-debug-livepatch-develUpgrade kernel-64kb-develUpgrade kernel-rt_debugUpgrade kernel-default-extraUpgrade dtb-amazonUpgrade kernel-devel-azureUpgrade kselftests-kmp-defaultUpgrade kernel-zfcpdumpUpgrade kernel-develUpgrade kernel-macrosUpgrade kernel-64kb-livepatch-develUpgrade dtb-exynosUpgrade dtb-xilinxUpgrade dtb-apmUpgrade dtb-mediatekUpgrade dtb-hisiliconUpgrade kernel-azure-livepatch-develUpgrade kernel-syms-rtUpgrade kernel-rt-livepatch-develUpgrade kernel-kvmsmall-livepatch-develUpgrade kernel-sourceUpgrade cluster-md-kmp-defaultUpgrade dtb-appleUpgrade dtb-freescaleUpgrade dtb-armUpgrade kernel-symsUpgrade kernel-default-vdsoUpgrade reiserfs-kmp-defaultUpgrade dtb-amlogicUpgrade gfs2-kmp-rtUpgrade kernel-debug-develUpgrade kernel-default-optionalUpgrade kernel-default-develUpgrade kernel-64kbUpgrade dtb-lgUpgrade cluster-md-kmp-azureUpgrade kernel-kvmsmall-develUpgrade dlm-kmp-64kbUpgrade kernel-default-livepatchUpgrade ocfs2-kmp-rtUpgrade kernel-rt-develUpgrade dlm-kmp-azureUpgrade kernel-devel-rtUpgrade dtb-amdUpgrade kernel-rt_debug-vdsoUpgrade gfs2-kmp-64kbUpgrade kernel-kvmsmallUpgrade kernel-preemptUpgrade kernel-64kb-optionalUpgrade kernel-syms-azureUpgrade kselftests-kmp-64kbUpgrade kernel-debugUpgrade ocfs2-kmp-azureUpgrade reiserfs-kmp-azureUpgrade dtb-rockchipUpgrade kernel-rt_debug-develUpgrade dtb-renesasUpgrade gfs2-kmp-azureUpgrade dtb-qcomUpgrade kernel-rt-vdsoUpgrade dtb-nvidiaUpgrade kernel-default-baseUpgrade kselftests-kmp-azureUpgrade kernel-rt_debug-livepatch-develUpgrade kernel-docs-htmlUpgrade kernel-default-base-rebuildUpgrade cluster-md-kmp-64kbUpgrade kernel-preempt-develUpgrade kernel-debug-vdsoUpgrade kernel-azureUpgrade kernel-rt-optionalUpgrade dtb-caviumUpgrade dlm-kmp-defaultUpgrade dlm-kmp-rtUpgrade dtb-alteraUpgrade ocfs2-kmp-defaultUpgrade kselftests-kmp-rtUpgrade dtb-socionextUpgrade dtb-broadcomUpgrade ocfs2-kmp-64kbUpgrade reiserfs-kmp-rtUpgrade kernel-64kb-extraUpgrade kernel-obs-buildUpgrade kernel-source-vanillaUpgrade reiserfs-kmp-64kbUpgrade kernel-default-livepatch-develUpgrade dtb-sprdUpgrade dtb-marvellUpgrade kernel-source-rtUpgrade kernel-azure-develUpgrade kernel-defaultUpgrade cluster-md-kmp-rtUpgrade kernel-rtUpgrade dtb-allwinnerUpgrade kernel-docsUpgrade kernel-rt-extraUpgrade kernel-kvmsmall-vdsoUpgrade kernel-azure-optionalUpgrade gfs2-kmp-default | Aug 9, 2024 | May 22, 2024 |
| Ubuntu | — | Upgrade linux-azure-fipsUpgrade linux-raspiUpgrade linux-aws-hweUpgrade linux-aws-5.4Upgrade linux-oracleUpgrade linux-oracle-5.4Upgrade linux-gkeopUpgrade linux-fipsUpgrade linux-kvmUpgrade linuxUpgrade linux-hweUpgrade linux-aws-fipsUpgrade linux-awsUpgrade linux-azure-4.15Upgrade linux-raspi-5.4Upgrade linux-hwe-5.4Upgrade linux-bluefieldUpgrade linux-gcp-4.15Upgrade linux-azureUpgrade linux-azure-5.4Upgrade linux-ibmUpgrade linux-gcpUpgrade linux-gcp-5.4Upgrade linux-gcp-fips | Nov 19, 2024 | May 22, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | May 22, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub