In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: fix possible kfree_skb of ERR_PTR After the patch in the "Fixes" tag, the allocation of the "reply" skb can happen either before or after locking the ovs_mutex. However, error cleanups still follow the classical reversed order, assuming "reply" is allocated before locking: it is freed after unlocking. If "reply" allocation happens after locking the mutex and it fails, "reply" is left with an ERR_PTR, and execution jumps to the correspondent cleanup stage which will try to free an invalid pointer. Fix this by setting the pointer to NULL after having saved its error value.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
| Attack Vector | LOCAL |
|---|---|
| Attack Complexity | LOW |
| Privileges Required | LOW |
| User Interaction | NONE |
| Scope | UNCHANGED |
| Confidentiality Impact | NONE |
| Integrity Impact | NONE |
| Availability Impact | HIGH |
| Source | Type | Description |
|---|---|---|
| [email protected] | Primary |
en
CWE-401
|
| Vendor | Product | Version | Update | Type |
|---|---|---|---|---|
| linux | linux_kernel | * | <built-in method update of dict object at 0x7fd36ad4f2c0> | Operating System |
| linux | linux_kernel | * | <built-in method update of dict object at 0x7fd384317040> | Operating System |
| linux | linux_kernel | * | <built-in method update of dict object at 0x7fd3855dbc80> | Operating System |
| linux | linux_kernel | * | <built-in method update of dict object at 0x7fd36041f940> | Operating System |
| linux | linux_kernel | * | <built-in method update of dict object at 0x7fd36ad4ff40> | Operating System |
| linux | linux_kernel | * | <built-in method update of dict object at 0x7fd36ad4c300> | Operating System |
| linux | linux_kernel | * | <built-in method update of dict object at 0x7fd3697d7700> | Operating System |
| linux | linux_kernel | 7.1 | <built-in method update of dict object at 0x7fd3841f3000> | Operating System |
| linux | linux_kernel | 7.1 | <built-in method update of dict object at 0x7fd3697d5a00> | Operating System |
| linux | linux_kernel | 7.1 | <built-in method update of dict object at 0x7fd36ad4ea40> | Operating System |
| linux | linux_kernel | 7.1 | <built-in method update of dict object at 0x7fd384e2b1c0> | Operating System |
| linux | linux_kernel | 7.1 | <built-in method update of dict object at 0x7fd3855db100> | Operating System |
| linux | linux_kernel | 7.1 | <built-in method update of dict object at 0x7fd36afa69c0> | Operating System |
| linux | linux_kernel | 7.1 | <built-in method update of dict object at 0x7fd2d3b93800> | Operating System |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:7.1:rc2:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:7.1:rc3:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:7.1:rc4:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:7.1:rc5:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:7.1:rc6:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:7.1:rc7:*:*:*:*:*:* |