CVE-2022-50355

In the Linux kernel, the following vulnerability has been resolved:

staging: vt6655: fix some erroneous memory clean-up loops

In some initialization functions of this driver, memory is allocated with i acting as an index variable and increasing from 0. The commit in Fixes introduces some clean-up codes in case of allocation failure, which free memory in reverse order with i decreasing to 0. However, there are some problems:

• The case i=0 is left out. Thus memory is leaked.
• In case memory allocation fails right from the start, the memory freeing loops will start with i=-1 and invalid memory locations will be accessed.

One of these loops has been fixed in commit c8ff91535880 (staging: vt6655: fix potential memory leak). Fix the remaining erroneous loops.

Weakness

The product does not sufficiently track and release allocated memory after it has been used, making the memory unavailable for reallocation and reuse.

Affected Software

Potential Mitigations

• Choose a language or tool that provides automatic memory management, or makes manual memory management less error-prone.
• For example, glibc in Linux provides protection against free of invalid pointers.
• When using Xcode to target OS X or iOS, enable automatic reference counting (ARC) [REF-391].
• To help correctly and consistently manage memory when programming in C++, consider using a smart pointer class such as std::auto_ptr (defined by ISO/IEC ISO/IEC 14882:2003), std::shared_ptr and std::unique_ptr (specified by an upcoming revision of the C++ standard, informally referred to as C++ 1x), or equivalent solutions such as Boost.

References

• https://git.kernel.org/stable/c/2a2db520e3ca5aafba7c211abfd397666c9b5f9d
• https://git.kernel.org/stable/c/637672a71f5016a40b0a6c0f3c8ad25eacedc8c3
• https://git.kernel.org/stable/c/88b9cc60f26e8a05d1ddbddf91b09ca2915f20e0
• https://git.kernel.org/stable/c/95ac62e8545be2b0a8cae0beef7c682e2e470e48
• https://git.kernel.org/stable/c/a9e9806d1c315bc50dce05479a079b9a104474b8
• https://git.kernel.org/stable/c/ed11b73c963292e7b49c0f37025c58ed3b7921d6
• https://git.kernel.org/stable/c/f19e5b7df54590c831f350381963f25585c8f7d5