In the Linux kernel, the following vulnerability has been resolved:
irqchip/gic-v3-its: Prevent double free on error
The error handling path in itsvpeirqdomainalloc() causes a double free when itsvpeinit() fails after successfully allocating at least one interrupt. This happens because itsvpeirqdomainfree() frees the interrupts along with the area bitmap and the vproppage and itsvpeirqdomainalloc() subsequently frees the area bitmap and the vproppage again.
Fix this by unconditionally invoking itsvpeirqdomainfree() which handles all cases correctly and by removing the bitmap/vproppage freeing from itsvpeirqdomain_alloc().
[ tglx: Massaged change log ]
{ "vanir_signatures": [ { "id": "CVE-2024-35847-009c8129", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5dbdbe1133911ca7d8466bb86885adec32ad9438", "deprecated": false, "signature_version": "v1", "signature_type": "Function", "digest": { "length": 1140.0, "function_hash": "155216211169833047805280178639511191491" }, "target": { "file": "drivers/irqchip/irq-gic-v3-its.c", "function": "its_vpe_irq_domain_alloc" } }, { "id": "CVE-2024-35847-10816466", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b72d2b1448b682844f995e660b77f2a1fabc1662", "deprecated": false, "signature_version": "v1", "signature_type": "Line", "digest": { "threshold": 0.9, "line_hashes": [ "23122647830163383128636231430505019154", "36071817615210289804863696753100605742", "316030567904332088607053455049593098041", "94388622994502288914788655630860830069", "323836014598154980310735914379650445289", "230836981687418563270381944390500446095", "52986443230923520105136048220033756581", "237614068858177329748726824536947247025", "104159745844544627077354873924772954529" ] }, "target": { "file": "drivers/irqchip/irq-gic-v3-its.c" } }, { "id": "CVE-2024-35847-1acbdd70", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c26591afd33adce296c022e3480dea4282b7ef91", "deprecated": false, "signature_version": "v1", "signature_type": "Function", "digest": { "length": 1180.0, "function_hash": "84912984328962022952568173266061412341" }, "target": { "file": "drivers/irqchip/irq-gic-v3-its.c", "function": "its_vpe_irq_domain_alloc" } }, { "id": "CVE-2024-35847-1e1d450f", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@dd681710ab77c8beafe2e263064cb1bd0e2d6ca9", "deprecated": false, "signature_version": "v1", "signature_type": "Line", "digest": { "threshold": 0.9, "line_hashes": [ "111846932092097568811671734819679490738", "36071817615210289804863696753100605742", "316030567904332088607053455049593098041", "94388622994502288914788655630860830069", "323836014598154980310735914379650445289", "230836981687418563270381944390500446095", "52986443230923520105136048220033756581", "237614068858177329748726824536947247025", "104159745844544627077354873924772954529" ] }, "target": { "file": "drivers/irqchip/irq-gic-v3-its.c" } }, { "id": "CVE-2024-35847-3349e093", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f5417ff561b8ac9a7e53c747b8627a7ab58378ae", "deprecated": false, "signature_version": "v1", "signature_type": "Line", "digest": { "threshold": 0.9, "line_hashes": [ "23122647830163383128636231430505019154", "36071817615210289804863696753100605742", "316030567904332088607053455049593098041", "94388622994502288914788655630860830069", "323836014598154980310735914379650445289", "230836981687418563270381944390500446095", "52986443230923520105136048220033756581", "237614068858177329748726824536947247025", "104159745844544627077354873924772954529" ] }, "target": { "file": "drivers/irqchip/irq-gic-v3-its.c" } }, { "id": "CVE-2024-35847-40cfdf40", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5dbdbe1133911ca7d8466bb86885adec32ad9438", "deprecated": false, "signature_version": "v1", "signature_type": "Line", "digest": { "threshold": 0.9, "line_hashes": [ "111846932092097568811671734819679490738", "36071817615210289804863696753100605742", "316030567904332088607053455049593098041", "94388622994502288914788655630860830069", "323836014598154980310735914379650445289", "230836981687418563270381944390500446095", "52986443230923520105136048220033756581", "237614068858177329748726824536947247025", "104159745844544627077354873924772954529" ] }, "target": { "file": "drivers/irqchip/irq-gic-v3-its.c" } }, { "id": "CVE-2024-35847-4ba15752", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@03170e657f62c26834172742492a8cb8077ef792", "deprecated": false, "signature_version": "v1", "signature_type": "Function", "digest": { "length": 1180.0, "function_hash": "84912984328962022952568173266061412341" }, "target": { "file": "drivers/irqchip/irq-gic-v3-its.c", "function": "its_vpe_irq_domain_alloc" } }, { "id": "CVE-2024-35847-54e86e0e", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c26591afd33adce296c022e3480dea4282b7ef91", "deprecated": false, "signature_version": "v1", "signature_type": "Line", "digest": { "threshold": 0.9, "line_hashes": [ "214312233660669899629225513901641782011", "252536802744241165624641622433097168060", "316030567904332088607053455049593098041", "94388622994502288914788655630860830069", "323836014598154980310735914379650445289", "230836981687418563270381944390500446095", "52986443230923520105136048220033756581", "237614068858177329748726824536947247025", "104159745844544627077354873924772954529" ] }, "target": { "file": "drivers/irqchip/irq-gic-v3-its.c" } }, { "id": "CVE-2024-35847-7019c219", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f5417ff561b8ac9a7e53c747b8627a7ab58378ae", "deprecated": false, "signature_version": "v1", "signature_type": "Function", "digest": { "length": 1057.0, "function_hash": "283509271849153289817921234418082434922" }, "target": { "file": "drivers/irqchip/irq-gic-v3-its.c", "function": "its_vpe_irq_domain_alloc" } }, { "id": "CVE-2024-35847-7d1a54c4", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b72d2b1448b682844f995e660b77f2a1fabc1662", "deprecated": false, "signature_version": "v1", "signature_type": "Function", "digest": { "length": 1057.0, "function_hash": "283509271849153289817921234418082434922" }, "target": { "file": "drivers/irqchip/irq-gic-v3-its.c", "function": "its_vpe_irq_domain_alloc" } }, { "id": "CVE-2024-35847-c8e69f71", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5b012f77abde89bf0be8a0547636184fea618137", "deprecated": false, "signature_version": "v1", "signature_type": "Line", "digest": { "threshold": 0.9, "line_hashes": [ "214312233660669899629225513901641782011", "252536802744241165624641622433097168060", "316030567904332088607053455049593098041", "94388622994502288914788655630860830069", "323836014598154980310735914379650445289", "230836981687418563270381944390500446095", "52986443230923520105136048220033756581", "237614068858177329748726824536947247025", "104159745844544627077354873924772954529" ] }, "target": { "file": "drivers/irqchip/irq-gic-v3-its.c" } }, { "id": "CVE-2024-35847-d4390b28", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@03170e657f62c26834172742492a8cb8077ef792", "deprecated": false, "signature_version": "v1", "signature_type": "Line", "digest": { "threshold": 0.9, "line_hashes": [ "214312233660669899629225513901641782011", "252536802744241165624641622433097168060", "316030567904332088607053455049593098041", "94388622994502288914788655630860830069", "323836014598154980310735914379650445289", "230836981687418563270381944390500446095", "52986443230923520105136048220033756581", "237614068858177329748726824536947247025", "104159745844544627077354873924772954529" ] }, "target": { "file": "drivers/irqchip/irq-gic-v3-its.c" } }, { "id": "CVE-2024-35847-d72eaedc", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@dd681710ab77c8beafe2e263064cb1bd0e2d6ca9", "deprecated": false, "signature_version": "v1", "signature_type": "Function", "digest": { "length": 1140.0, "function_hash": "155216211169833047805280178639511191491" }, "target": { "file": "drivers/irqchip/irq-gic-v3-its.c", "function": "its_vpe_irq_domain_alloc" } }, { "id": "CVE-2024-35847-df841739", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@aa44d21574751a7d6bca892eb8e0e9ac68372e52", "deprecated": false, "signature_version": "v1", "signature_type": "Line", "digest": { "threshold": 0.9, "line_hashes": [ "111846932092097568811671734819679490738", "36071817615210289804863696753100605742", "316030567904332088607053455049593098041", "94388622994502288914788655630860830069", "323836014598154980310735914379650445289", "230836981687418563270381944390500446095", "52986443230923520105136048220033756581", "237614068858177329748726824536947247025", "104159745844544627077354873924772954529" ] }, "target": { "file": "drivers/irqchip/irq-gic-v3-its.c" } }, { "id": "CVE-2024-35847-e008abd5", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@aa44d21574751a7d6bca892eb8e0e9ac68372e52", "deprecated": false, "signature_version": "v1", "signature_type": "Function", "digest": { "length": 1140.0, "function_hash": "155216211169833047805280178639511191491" }, "target": { "file": "drivers/irqchip/irq-gic-v3-its.c", "function": "its_vpe_irq_domain_alloc" } }, { "id": "CVE-2024-35847-e6597dbb", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5b012f77abde89bf0be8a0547636184fea618137", "deprecated": false, "signature_version": "v1", "signature_type": "Function", "digest": { "length": 1180.0, "function_hash": "84912984328962022952568173266061412341" }, "target": { "file": "drivers/irqchip/irq-gic-v3-its.c", "function": "its_vpe_irq_domain_alloc" } } ] }