CVE-2022-49436

In the Linux kernel, the following vulnerability has been resolved:

powerpc/papr_scm: Fix leaking nvdimm_events_map elements

Right now char * elements allocated for individual stat_id in papr_scm_priv.nvdimm_events_map[] during papr_scm_pmu_check_events(), get leaked in papr_scm_remove() and papr_scm_pmu_register(), papr_scm_pmu_check_events() error paths.

Also individual stat_id arent NULL terminated char * instead they are fixed 8-byte sized identifiers. However papr_scm_pmu_register() assumes it to be a NULL terminated char * and at other places it assumes it to be a papr_scm_perf_stat.stat_id sized string which is 8-byes in size.

Fix this by allocating the memory for papr_scm_priv.nvdimm_events_map to also include space for stat_id entries. This is possible since number of available events/stat_ids are known upfront. This saves some memory and one extra level of indirection from nvdimm_events_map to stat_id. Also rest of the code can continue to call kfree(papr_scm_priv.nvdimm_events_map) without needing to iterate over the array and free up individual elements.

Weakness

The product does not sufficiently track and release allocated memory after it has been used, making the memory unavailable for reallocation and reuse.

Affected Software

Potential Mitigations

• Choose a language or tool that provides automatic memory management, or makes manual memory management less error-prone.
• For example, glibc in Linux provides protection against free of invalid pointers.
• When using Xcode to target OS X or iOS, enable automatic reference counting (ARC) [REF-391].
• To help correctly and consistently manage memory when programming in C++, consider using a smart pointer class such as std::auto_ptr (defined by ISO/IEC ISO/IEC 14882:2003), std::shared_ptr and std::unique_ptr (specified by an upcoming revision of the C++ standard, informally referred to as C++ 1x), or equivalent solutions such as Boost.

References

• https://git.kernel.org/stable/c/0e0946e22f3665d27325d389ff45ade6e93f3678
• https://git.kernel.org/stable/c/b073096df4dec70d0436321b7093bad27ae91f9e