ZeroHour

CVE-2023-53234

CVSS 3.1
5.5 medium
EPSS
<1%p5
Published
()
Modified
Description

In the Linux kernel, the following vulnerability has been resolved: watchdog: Fix kmemleak in watchdog_cdev_register kmemleak reports memory leaks in watchdog_dev_register, as follows: unreferenced object 0xffff888116233000 (size 2048): comm ""modprobe"", pid 28147, jiffies 4353426116 (age 61.741s) hex dump (first 32 bytes): 80 fa b9 05 81 88 ff ff 08 30 23 16 81 88 ff ff .........0#..... 08 30 23 16 81 88 ff ff 00 00 00 00 00 00 00 00 .0#............. backtrace: [ ] __kmem_cache_alloc_node+0x157/0x220 [ ] kmalloc_trace+0x21/0x110 [ ] watchdog_dev_register+0x4e/0x780 [watchdog] [ ] __watchdog_register_device+0x4f0/0x680 [watchdog] [ ] watchdog_register_device+0xd2/0x110 [watchdog] [ ] 0xffffffffc10880ae [ ] do_one_initcall+0xcb/0x4d0 [ ] do_init_module+0x1ca/0x5f0 [ ] load_module+0x6133/0x70f0 ... unreferenced object 0xffff888105b9fa80 (size 16): comm ""modprobe"", pid 28147, jiffies 4353426116 (age 61.741s) hex dump (first 16 bytes): 77 61 74 63 68 64 6f 67 31 00 b9 05 81 88 ff ff watchdog1....... backtrace: [ ] __kmem_cache_alloc_node+0x157/0x220 [ ] __kmalloc_node_track_caller+0x44/0x1b0 [ ] kvasprintf+0xb5/0x140 [ ] kvasprintf_const+0x55/0x180 [ ] kobject_set_name_vargs+0x56/0x150 [ ] dev_set_name+0xab/0xe0 [ ] watchdog_dev_register+0x285/0x780 [watchdog] [ ] __watchdog_register_device+0x4f0/0x680 [watchdog] [ ] watchdog_register_device+0xd2/0x110 [watchdog] [ ] 0xffffffffc10880ae [ ] do_one_initcall+0xcb/0x4d0 [ ] do_init_module+0x1ca/0x5f0 [ ] load_module+0x6133/0x70f0 ... The reason is that put_device is not be called if cdev_device_add fails and wdd->id != 0. watchdog_cdev_register wd_data = kzalloc [1] err = dev_set_name [2] .. err = cdev_device_add if (err) { if (wdd->id == 0) { // wdd->id != 0 .. } return err; // [1],[2] would be leaked To fix it, call put_device in all wdd->id cases.

Vendors
linux
Products
linux kernel
Weakness
CWE-401
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

In the news

No ingested article mentions this CVE yet.