CVE-2022-48975 Information

Description

In the Linux kernel the following vulnerability has been resolved:

gpiolib: fix memory leak in gpiochip_setup_dev()

Here is a backtrace report about memory leak detected in gpiochip_setup_dev():

unreferenced object 0xffff88810b406400 (size 512): comm \python3\ pid 1682 jiffies 4295346908 (age 24.090s) backtrace: kmalloc_trace device_add device_private_init at drivers/base/core.c:3361 (inlined by) device_add at drivers/base/core.c:3411 cdev_device_add gpiolib_cdev_register gpiochip_setup_dev gpiochip_add_data_with_key

gcdev_register() & gcdev_unregister() would call device_add() & device_del() (no matter CONFIG_GPIO_CDEV is enabled or not) to register/unregister device.

However if device_add() succeeds some resource (like struct device_private allocated by device_private_init()) is not released by device_del().

Therefore after device_add() succeeds by gcdev_register() it needs to call put_device() to release resource in the error handle path.

Here we move forward the register of release function and let it release every piece of resource by put_device() instead of kfree().

While at it fix another subtle issue i.e. when gc->ngpio is equal to 0 we still call kcalloc() and in case of further error kfree() on the ZERO_PTR pointer which is not NULL. It’s not a bug per se but rather waste of the resources and potentially wrong expectation about contents of the gdev->descs variable.

CVSS Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Reference

https://git.kernel.org/stable/c/6daaa84b621485fe28c401be18debf92ae8ef04a https://git.kernel.org/stable/c/371363716398ed718e389bea8c5e9843a79dde4e https://git.kernel.org/stable/c/ec851b23084b3a0af8bf0f5e51d33a8d678bdc49

Attack Complexity

LOW

Privileges Required

LOW

User Interaction Required

LOW

Scope

NONE

Confidentiality Impact

UNCHANGED

Integrity Impact

NONE

Availability Impact

NONE

Base Score

HIGH

Base Severity

5.5