From: Guenter Roeck <email@example.com> To: Kalle Valo <firstname.lastname@example.org> Cc: Hui Peng <email@example.com>, firstname.lastname@example.org, Mathias Payer <email@example.com>, "David S. Miller" <firstname.lastname@example.org>, email@example.com, firstname.lastname@example.org, email@example.com Subject: Re: [PATCH] Fix a double free bug in rsi_91x_deinit Date: Sun, 1 Sep 2019 07:08:29 -0700 [thread overview] Message-ID: <firstname.lastname@example.org> (raw) In-Reply-To: <email@example.com> On 9/1/19 1:03 AM, Kalle Valo wrote: > Guenter Roeck <firstname.lastname@example.org> writes: > >> On Mon, Aug 19, 2019 at 06:02:29PM -0400, Hui Peng wrote: >>> `dev` (struct rsi_91x_usbdev *) field of adapter >>> (struct rsi_91x_usbdev *) is allocated and initialized in >>> `rsi_init_usb_interface`. If any error is detected in information >>> read from the device side, `rsi_init_usb_interface` will be >>> freed. However, in the higher level error handling code in >>> `rsi_probe`, if error is detected, `rsi_91x_deinit` is called >>> again, in which `dev` will be freed again, resulting double free. >>> >>> This patch fixes the double free by removing the free operation on >>> `dev` in `rsi_init_usb_interface`, because `rsi_91x_deinit` is also >>> used in `rsi_disconnect`, in that code path, the `dev` field is not >>> (and thus needs to be) freed. >>> >>> This bug was found in v4.19, but is also present in the latest version >>> of kernel. >>> >>> Reported-by: Hui Peng <email@example.com> >>> Reported-by: Mathias Payer <firstname.lastname@example.org> >>> Signed-off-by: Hui Peng <email@example.com> >> >> FWIW: >> >> Reviewed-by: Guenter Roeck <firstname.lastname@example.org> >> >> This patch is listed as fix for CVE-2019-15504, which has a CVSS 2.0 score >> of 10.0 (high) and CVSS 3.0 score of 9.8 (critical). > > A double free in error path is considered as a critical CVE issue? I'm > very curious, why is that? > You'd have to ask the people assigning CVSS scores. However, if the memory was reallocated, that reallocated memory (which is still in use) is freed. Then all kinds of bad things can happen. Guenter >> Are there any plans to apply this patch to the upstream kernel anytime >> soon ? > > I was on vacation last week and hence I have not been able to apply any > wireless patches. I should be able to catch up next week. >
next prev parent reply other threads:[~2019-09-01 14:08 UTC|newest] Thread overview: 10+ messages / expand[flat|nested] mbox.gz Atom feed top 2019-08-19 22:02 Hui Peng 2019-08-31 18:18 ` Guenter Roeck 2019-08-31 18:32 ` Hui Peng 2019-09-01 8:03 ` Kalle Valo 2019-09-01 14:08 ` Guenter Roeck [this message] 2019-09-02 18:47 ` Greg KH 2019-09-02 19:32 ` Guenter Roeck 2019-09-02 20:06 ` Greg KH 2019-09-03 0:35 ` Guenter Roeck 2019-09-03 13:55 ` [PATCH] rsi: fix a double free bug in rsi_91x_deinit() Kalle Valo
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --email@example.com \ --firstname.lastname@example.org \ --email@example.com \ --firstname.lastname@example.org \ --email@example.com \ --firstname.lastname@example.org \ --email@example.com \ --firstname.lastname@example.org \ --email@example.com \ --firstname.lastname@example.org \ --subject='Re: [PATCH] Fix a double free bug in rsi_91x_deinit' \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: link
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox; as well as URLs for NNTP newsgroup(s).