In the Linux kernel, the following vulnerability has been resolved:
irqchip/gic-v3-its: Prevent double free on error
The error handling path in itsvpeirqdomainalloc() causes a double free when itsvpeinit() fails after successfully allocating at least one interrupt. This happens because itsvpeirqdomainfree() frees the interrupts along with the area bitmap and the vproppage and itsvpeirqdomainalloc() subsequently frees the area bitmap and the vproppage again.
Fix this by unconditionally invoking itsvpeirqdomainfree() which handles all cases correctly and by removing the bitmap/vproppage freeing from itsvpeirqdomain_alloc().
[ tglx: Massaged change log ]
[
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5dbdbe1133911ca7d8466bb86885adec32ad9438",
"digest": {
"function_hash": "155216211169833047805280178639511191491",
"length": 1140.0
},
"id": "CVE-2024-35847-009c8129",
"target": {
"file": "drivers/irqchip/irq-gic-v3-its.c",
"function": "its_vpe_irq_domain_alloc"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b72d2b1448b682844f995e660b77f2a1fabc1662",
"digest": {
"line_hashes": [
"23122647830163383128636231430505019154",
"36071817615210289804863696753100605742",
"316030567904332088607053455049593098041",
"94388622994502288914788655630860830069",
"323836014598154980310735914379650445289",
"230836981687418563270381944390500446095",
"52986443230923520105136048220033756581",
"237614068858177329748726824536947247025",
"104159745844544627077354873924772954529"
],
"threshold": 0.9
},
"id": "CVE-2024-35847-10816466",
"target": {
"file": "drivers/irqchip/irq-gic-v3-its.c"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c26591afd33adce296c022e3480dea4282b7ef91",
"digest": {
"function_hash": "84912984328962022952568173266061412341",
"length": 1180.0
},
"id": "CVE-2024-35847-1acbdd70",
"target": {
"file": "drivers/irqchip/irq-gic-v3-its.c",
"function": "its_vpe_irq_domain_alloc"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@dd681710ab77c8beafe2e263064cb1bd0e2d6ca9",
"digest": {
"line_hashes": [
"111846932092097568811671734819679490738",
"36071817615210289804863696753100605742",
"316030567904332088607053455049593098041",
"94388622994502288914788655630860830069",
"323836014598154980310735914379650445289",
"230836981687418563270381944390500446095",
"52986443230923520105136048220033756581",
"237614068858177329748726824536947247025",
"104159745844544627077354873924772954529"
],
"threshold": 0.9
},
"id": "CVE-2024-35847-1e1d450f",
"target": {
"file": "drivers/irqchip/irq-gic-v3-its.c"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5dbdbe1133911ca7d8466bb86885adec32ad9438",
"digest": {
"line_hashes": [
"111846932092097568811671734819679490738",
"36071817615210289804863696753100605742",
"316030567904332088607053455049593098041",
"94388622994502288914788655630860830069",
"323836014598154980310735914379650445289",
"230836981687418563270381944390500446095",
"52986443230923520105136048220033756581",
"237614068858177329748726824536947247025",
"104159745844544627077354873924772954529"
],
"threshold": 0.9
},
"id": "CVE-2024-35847-40cfdf40",
"target": {
"file": "drivers/irqchip/irq-gic-v3-its.c"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@03170e657f62c26834172742492a8cb8077ef792",
"digest": {
"function_hash": "84912984328962022952568173266061412341",
"length": 1180.0
},
"id": "CVE-2024-35847-4ba15752",
"target": {
"file": "drivers/irqchip/irq-gic-v3-its.c",
"function": "its_vpe_irq_domain_alloc"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c26591afd33adce296c022e3480dea4282b7ef91",
"digest": {
"line_hashes": [
"214312233660669899629225513901641782011",
"252536802744241165624641622433097168060",
"316030567904332088607053455049593098041",
"94388622994502288914788655630860830069",
"323836014598154980310735914379650445289",
"230836981687418563270381944390500446095",
"52986443230923520105136048220033756581",
"237614068858177329748726824536947247025",
"104159745844544627077354873924772954529"
],
"threshold": 0.9
},
"id": "CVE-2024-35847-54e86e0e",
"target": {
"file": "drivers/irqchip/irq-gic-v3-its.c"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b72d2b1448b682844f995e660b77f2a1fabc1662",
"digest": {
"function_hash": "283509271849153289817921234418082434922",
"length": 1057.0
},
"id": "CVE-2024-35847-7d1a54c4",
"target": {
"file": "drivers/irqchip/irq-gic-v3-its.c",
"function": "its_vpe_irq_domain_alloc"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5b012f77abde89bf0be8a0547636184fea618137",
"digest": {
"line_hashes": [
"214312233660669899629225513901641782011",
"252536802744241165624641622433097168060",
"316030567904332088607053455049593098041",
"94388622994502288914788655630860830069",
"323836014598154980310735914379650445289",
"230836981687418563270381944390500446095",
"52986443230923520105136048220033756581",
"237614068858177329748726824536947247025",
"104159745844544627077354873924772954529"
],
"threshold": 0.9
},
"id": "CVE-2024-35847-c8e69f71",
"target": {
"file": "drivers/irqchip/irq-gic-v3-its.c"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@03170e657f62c26834172742492a8cb8077ef792",
"digest": {
"line_hashes": [
"214312233660669899629225513901641782011",
"252536802744241165624641622433097168060",
"316030567904332088607053455049593098041",
"94388622994502288914788655630860830069",
"323836014598154980310735914379650445289",
"230836981687418563270381944390500446095",
"52986443230923520105136048220033756581",
"237614068858177329748726824536947247025",
"104159745844544627077354873924772954529"
],
"threshold": 0.9
},
"id": "CVE-2024-35847-d4390b28",
"target": {
"file": "drivers/irqchip/irq-gic-v3-its.c"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@dd681710ab77c8beafe2e263064cb1bd0e2d6ca9",
"digest": {
"function_hash": "155216211169833047805280178639511191491",
"length": 1140.0
},
"id": "CVE-2024-35847-d72eaedc",
"target": {
"file": "drivers/irqchip/irq-gic-v3-its.c",
"function": "its_vpe_irq_domain_alloc"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@aa44d21574751a7d6bca892eb8e0e9ac68372e52",
"digest": {
"line_hashes": [
"111846932092097568811671734819679490738",
"36071817615210289804863696753100605742",
"316030567904332088607053455049593098041",
"94388622994502288914788655630860830069",
"323836014598154980310735914379650445289",
"230836981687418563270381944390500446095",
"52986443230923520105136048220033756581",
"237614068858177329748726824536947247025",
"104159745844544627077354873924772954529"
],
"threshold": 0.9
},
"id": "CVE-2024-35847-df841739",
"target": {
"file": "drivers/irqchip/irq-gic-v3-its.c"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@aa44d21574751a7d6bca892eb8e0e9ac68372e52",
"digest": {
"function_hash": "155216211169833047805280178639511191491",
"length": 1140.0
},
"id": "CVE-2024-35847-e008abd5",
"target": {
"file": "drivers/irqchip/irq-gic-v3-its.c",
"function": "its_vpe_irq_domain_alloc"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5b012f77abde89bf0be8a0547636184fea618137",
"digest": {
"function_hash": "84912984328962022952568173266061412341",
"length": 1180.0
},
"id": "CVE-2024-35847-e6597dbb",
"target": {
"file": "drivers/irqchip/irq-gic-v3-its.c",
"function": "its_vpe_irq_domain_alloc"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
}
]