In the Linux kernel, the following vulnerability has been resolved: block: fix potential invalid pointer dereference in blk_add_partition The blk_add_partition() function initially used a single if-condition (IS_ERR(part)) to check for errors when adding a partition. This was modified to handle the specific case of -ENXIO separately, allowing the function to proceed without logging the error in this case. However, this change unintentionally left a path where md_autodetect_dev() could be called without confirming that part is a valid pointer. This commit separates the error handling logic by splitting the initial if-condition, improving code readability and handling specific error scenarios explicitly. The function now distinguishes the general error case from -ENXIO without altering the existing behavior of md_autodetect_dev() calls.
En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: block: fix potential no valid pointer dereference in blk_add_partition La función blk_add_partition() inicialmente usaba una sola condición if (IS_ERR(part)) para verificar errores al agregar una partición. Esto se modificó para manejar el caso específico de -ENXIO por separado, lo que permite que la función continúe sin registrar el error en este caso. Sin embargo, este cambio dejó involuntariamente una ruta donde se podía llamar a md_autodetect_dev() sin confirmar que part es un puntero válido. Esta confirmación separa la lógica de manejo de errores al dividir la condición if inicial, lo que mejora la legibilidad del código y maneja escenarios de error específicos de manera explícita. La función ahora distingue el caso de error general de -ENXIO sin alterar el comportamiento existente de las llamadas a md_autodetect_dev().
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
| Attack Vector | LOCAL |
|---|---|
| Attack Complexity | LOW |
| Privileges Required | LOW |
| User Interaction | NONE |
| Scope | UNCHANGED |
| Confidentiality Impact | NONE |
| Integrity Impact | NONE |
| Availability Impact | HIGH |
| Source | Type | Description |
|---|---|---|
| [email protected] | Primary |
en
CWE-476
|
| Vendor | Product | Version | Update | Type |
|---|---|---|---|---|
| linux | linux_kernel | * | <built-in method update of dict object at 0x7fd3694ca280> | Operating System |
| linux | linux_kernel | * | <built-in method update of dict object at 0x7fd368634100> | Operating System |
| linux | linux_kernel | * | <built-in method update of dict object at 0x7fd369b56f80> | Operating System |
| linux | linux_kernel | * | <built-in method update of dict object at 0x7fd36b72b840> | Operating System |
| linux | linux_kernel | * | <built-in method update of dict object at 0x7fd3694cb0c0> | Operating System |
| linux | linux_kernel | * | <built-in method update of dict object at 0x7fd368635180> | Operating System |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |