qlcnic: prevent ->dcb use-after-free on qlcnic_dcb_enable() failure (Linux Linux)

CVE-2022-50288
MEDIUM 5.5

At a glance

Source
NVD
EPSS
EPSS 0.16 % · percentile 5 ()
State
PUBLISHED
Published
Updated
Assigner
Linux
NVD status
Analyzed

Description

In the Linux kernel, the following vulnerability has been resolved: qlcnic: prevent ->dcb use-after-free on qlcnic_dcb_enable() failure adapter->dcb would get silently freed inside qlcnic_dcb_enable() in case qlcnic_dcb_attach() would return an error, which always happens under OOM conditions. This would lead to use-after-free because both of the existing callers invoke qlcnic_dcb_get_info() on the obtained pointer, which is potentially freed at that point. Propagate errors from qlcnic_dcb_enable(), and instead free the dcb pointer at callsite using qlcnic_dcb_free(). This also removes the now unused qlcnic_clear_dcb_ops() helper, which was a simple wrapper around kfree() also causing memory leaks for partially initialized dcb. Found by Linux Verification Center (linuxtesting.org) with the SVACE static analysis tool.

Weaknesses (CWE)

References

Scores

VersionScoreVectorScored by
CVSS 3.1MEDIUM 5.5CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HNVD · nvd@nist.gov (Primary)

European references

CERT-FR advisories

Affected configurations (NVD CPE)

Affected products

ProductVersions
Linux · Linuxaffected 3c44bba1d270cb1620b4fe76786d0968118cb86b < 36999236f0b12d5de21a6f40e93b570727b9ceb2 ; affected 3c44bba1d270cb1620b4fe76786d0968118cb86b < d12a7510293d3370b234b0b7c5eda33e58786768 ; affected 3c44bba1d270cb1620b4fe76786d0968118cb86b < 8f97eeb02a553cdc78c83a0596448a370e1518c4 ; affected 3c44bba1d270cb1620b4fe76786d0968118cb86b < 513787ff9a331b461115e8a145a983d650a84fcb ; affected 3c44bba1d270cb1620b4fe76786d0968118cb86b < 95df720e64a6409d8152827a776c43f615e3321a ; affected 3c44bba1d270cb1620b4fe76786d0968118cb86b < 8df1dc04ce0e4c03b51a756749c250a9cb17d707
Linux · Linuxaffected 3.14 ; unaffected 0 < 3.14 ; unaffected 4.14.303 ≤ 4.14.* ; unaffected 4.19.270 ≤ 4.19.* ; unaffected 5.4.229 ≤ 5.4.* ; unaffected 5.10.163 ≤ 5.10.*

Sources

SourceLicence
CVE List (CVEProject cvelistV5)CVE Program Terms of Use
EPSS (FIRST.org)FIRST — attribution requested
ENISA EUVDENISA — reproduction authorised, source acknowledged
CERT-FR (ANSSI)Licence Ouverte / Etalab 2.0
NVD (NIST) via fkie-cad/nvd-json-data-feedsPublic domain — this product uses data from the NVD API but is not endorsed or certified by the NVD