In the Linux kernel, the following vulnerability has been resolved:
selinux: fix double free of cond_list on error paths
On error path from condreadlist() and duplicatepolicydbcondlist() the condlistdestroy() gets called a second time in caller functions, resulting in NULL pointer deref. Fix this by resetting the condlistlen to 0 in condlist_destroy(), making subsequent calls a noop.
Also consistently reset the cond_list pointer to NULL after freeing.
[PM: fix line lengths in the description]
{ "vanir_signatures": [ { "signature_version": "v1", "digest": { "length": 675.0, "function_hash": "271158614185318737809265523885877644611" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7ed9cbf7ac0d4ed86b356e1b944304ae9ee450d4", "deprecated": false, "target": { "file": "security/selinux/ss/conditional.c", "function": "cond_read_list" }, "signature_type": "Function", "id": "CVE-2022-48740-0eee0259" }, { "signature_version": "v1", "digest": { "length": 189.0, "function_hash": "23668602218780961121419773090136504333" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@186edf7e368c40d06cf727a1ad14698ea67b74ad", "deprecated": false, "target": { "file": "security/selinux/ss/conditional.c", "function": "cond_list_destroy" }, "signature_type": "Function", "id": "CVE-2022-48740-1b4e3f5d" }, { "signature_version": "v1", "digest": { "threshold": 0.9, "line_hashes": [ "238746905916334753048206561915799763286", "191856447137408364423078071210843059695", "35657816910400945853616419752874461697", "323172306952930185540563542005395540542", "288368520001180506248356249860786613336", "269757860841051431279544199350949011712", "40126304074664182362512332174844493621", "277197832233747350864065261512538003550" ] }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7ed9cbf7ac0d4ed86b356e1b944304ae9ee450d4", "deprecated": false, "target": { "file": "security/selinux/ss/conditional.c" }, "signature_type": "Line", "id": "CVE-2022-48740-2415cbbb" }, { "signature_version": "v1", "digest": { "threshold": 0.9, "line_hashes": [ "238746905916334753048206561915799763286", "191856447137408364423078071210843059695", "35657816910400945853616419752874461697", "323172306952930185540563542005395540542", "288368520001180506248356249860786613336", "269757860841051431279544199350949011712", "40126304074664182362512332174844493621", "277197832233747350864065261512538003550" ] }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f446089a268c8fc6908488e991d28a9b936293db", "deprecated": false, "target": { "file": "security/selinux/ss/conditional.c" }, "signature_type": "Line", "id": "CVE-2022-48740-2632fa69" }, { "signature_version": "v1", "digest": { "length": 189.0, "function_hash": "23668602218780961121419773090136504333" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f446089a268c8fc6908488e991d28a9b936293db", "deprecated": false, "target": { "file": "security/selinux/ss/conditional.c", "function": "cond_list_destroy" }, "signature_type": "Function", "id": "CVE-2022-48740-30f6da06" }, { "signature_version": "v1", "digest": { "length": 675.0, "function_hash": "271158614185318737809265523885877644611" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@186edf7e368c40d06cf727a1ad14698ea67b74ad", "deprecated": false, "target": { "file": "security/selinux/ss/conditional.c", "function": "cond_read_list" }, "signature_type": "Function", "id": "CVE-2022-48740-5b39bb4f" }, { "signature_version": "v1", "digest": { "threshold": 0.9, "line_hashes": [ "238746905916334753048206561915799763286", "191856447137408364423078071210843059695", "35657816910400945853616419752874461697", "323172306952930185540563542005395540542", "288368520001180506248356249860786613336", "269757860841051431279544199350949011712", "40126304074664182362512332174844493621", "277197832233747350864065261512538003550" ] }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@70caa32e6d81f45f0702070c0e4dfe945e92fbd7", "deprecated": false, "target": { "file": "security/selinux/ss/conditional.c" }, "signature_type": "Line", "id": "CVE-2022-48740-826ae511" }, { "signature_version": "v1", "digest": { "length": 189.0, "function_hash": "23668602218780961121419773090136504333" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@70caa32e6d81f45f0702070c0e4dfe945e92fbd7", "deprecated": false, "target": { "file": "security/selinux/ss/conditional.c", "function": "cond_list_destroy" }, "signature_type": "Function", "id": "CVE-2022-48740-8dec2845" }, { "signature_version": "v1", "digest": { "length": 675.0, "function_hash": "271158614185318737809265523885877644611" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@70caa32e6d81f45f0702070c0e4dfe945e92fbd7", "deprecated": false, "target": { "file": "security/selinux/ss/conditional.c", "function": "cond_read_list" }, "signature_type": "Function", "id": "CVE-2022-48740-b3276b3a" }, { "signature_version": "v1", "digest": { "length": 189.0, "function_hash": "23668602218780961121419773090136504333" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7ed9cbf7ac0d4ed86b356e1b944304ae9ee450d4", "deprecated": false, "target": { "file": "security/selinux/ss/conditional.c", "function": "cond_list_destroy" }, "signature_type": "Function", "id": "CVE-2022-48740-bc66d85f" }, { "signature_version": "v1", "digest": { "length": 675.0, "function_hash": "271158614185318737809265523885877644611" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f446089a268c8fc6908488e991d28a9b936293db", "deprecated": false, "target": { "file": "security/selinux/ss/conditional.c", "function": "cond_read_list" }, "signature_type": "Function", "id": "CVE-2022-48740-cb12468f" }, { "signature_version": "v1", "digest": { "threshold": 0.9, "line_hashes": [ "238746905916334753048206561915799763286", "191856447137408364423078071210843059695", "35657816910400945853616419752874461697", "323172306952930185540563542005395540542", "288368520001180506248356249860786613336", "269757860841051431279544199350949011712", "40126304074664182362512332174844493621", "277197832233747350864065261512538003550" ] }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@186edf7e368c40d06cf727a1ad14698ea67b74ad", "deprecated": false, "target": { "file": "security/selinux/ss/conditional.c" }, "signature_type": "Line", "id": "CVE-2022-48740-d0c43275" } ] }