CVE-2022-50433

In the Linux kernel, the following vulnerability has been resolved:

efi: ssdt: Dont free memory if ACPI table was loaded successfully

Amadeusz reports KASAN use-after-free errors introduced by commit 3881ee0b1edc (efi: avoid efivars layer when loading SSDTs from variables). The problem appears to be that the memory that holds the new ACPI table is now freed unconditionally, instead of only when the ACPI core reported a failure to load the table.

So lets fix this, by omitting the kfree() on success.

Weakness

The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory “belongs” to the code that operates on the new pointer.

Affected Software

Potential Mitigations

References

• https://git.kernel.org/stable/c/11497fd69cd2282538ec6eb4cda1d16fc061233d
• https://git.kernel.org/stable/c/4b017e59f01097f19b938f6dc4dc2c4720701610