CVE-2023-53800

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> ubi: Fix use-after-free when volume resizing failed<br /> <br /> There is an use-after-free problem reported by KASAN:<br /> ==================================================================<br /> BUG: KASAN: use-after-free in ubi_eba_copy_table+0x11f/0x1c0 [ubi]<br /> Read of size 8 at addr ffff888101eec008 by task ubirsvol/4735<br /> <br /> CPU: 2 PID: 4735 Comm: ubirsvol<br /> Not tainted 6.1.0-rc1-00003-g84fa3304a7fc-dirty #14<br /> Hardware name: QEMU Standard PC (i440FX + PIIX, 1996),<br /> BIOS 1.14.0-1.fc33 04/01/2014<br /> Call Trace:<br /> <br /> dump_stack_lvl+0x34/0x44<br /> print_report+0x171/0x472<br /> kasan_report+0xad/0x130<br /> ubi_eba_copy_table+0x11f/0x1c0 [ubi]<br /> ubi_resize_volume+0x4f9/0xbc0 [ubi]<br /> ubi_cdev_ioctl+0x701/0x1850 [ubi]<br /> __x64_sys_ioctl+0x11d/0x170<br /> do_syscall_64+0x35/0x80<br /> entry_SYSCALL_64_after_hwframe+0x46/0xb0<br /> <br /> <br /> When ubi_change_vtbl_record() returns an error in ubi_resize_volume(),<br /> "new_eba_tbl" will be freed on error handing path, but it is holded<br /> by "vol-&gt;eba_tbl" in ubi_eba_replace_table(). It means that the liftcycle<br /> of "vol-&gt;eba_tbl" and "vol" are different, so when resizing volume in<br /> next time, it causing an use-after-free fault.<br /> <br /> Fix it by not freeing "new_eba_tbl" after it replaced in<br /> ubi_eba_replace_table(), while will be freed in next volume resizing.