CVE-2010-3080: Double Free

First published: Mon Sep 06 2010(Updated: )

Description of problem: There is a bug in snd_seq_oss_open from sound/core/seq/oss/seq_oss_init.c. So here's the error path for some setup failure: _error: snd_seq_oss_writeq_delete(dp->writeq); snd_seq_oss_readq_delete(dp->readq); snd_seq_oss_synth_cleanup(dp); snd_seq_oss_midi_cleanup(dp); delete_port(dp); delete_seq_queue(dp->queue); kfree(dp); This looks okay, but actually, delete_port calls port_delete (eventually... this code is tough to follow) which does a free_devinfo on the owner struct seq_oss_devinfo, here (around ~269 in seq_ports.c): if (port->private_free) port->private_free(port->private_data); because of this (around ~334 in seq_oss_init.c): memset(&callback, 0, sizeof(callback)); callback.owner = THIS_MODULE; callback.private_data = dp; callback.event_input = snd_seq_oss_event_input; callback.private_free = free_devinfo; port.kernel = &callback; Which does this: static void free_devinfo(void *private) { struct seq_oss_devinfo *dp = (struct seq_oss_devinfo *)private; if (dp->timer) snd_seq_oss_timer_delete(dp->timer); if (dp->writeq) snd_seq_oss_writeq_delete(dp->writeq); if (dp->readq) snd_seq_oss_readq_delete(dp->readq); kfree(dp); } So..... delete_port(dp); delete_seq_queue(dp->queue); <= Oops, dereferencing released pointer. kfree(dp); <= Oops, double free. Acknowledgements: Red Hat would like to thank Tavis Ormandy for reporting this issue.

Credit: secalert@redhat.com secalert@redhat.com

Never miss a vulnerability like this again

Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.

Read MoreStart Free Trial

• agent/type
• collector/launchpad-cve
• source/Launchpad
• collector/redhat-bugzilla
• source/Red Hat
• alias/CVE-2010-3080
• agent/first-publish-date
• agent/author
• collector/security-tracker-debian
• source/Debian
• agent/software-canonical-lookup
• agent/severity
• agent/remedy
• agent/weakness
• collector/usn-cve
• source/Ubuntu
• agent/references
• agent/description
• agent/event
• agent/last-modified-date
• agent/trending
• agent/source
• collector/nvd-index
• agent/software-canonical-lookup-request
• collector/nvd-cve
• source/NVD
• collector/nvd-historical
• agent/softwarecombine
• agent/tags
• package-manager/debian
• vendor/linux
• canonical/linux kernel
• version/linux kernel/2.6.36
• version/linux kernel/2.6.36-rc1
• version/linux kernel/2.6.36-rc2
• version/linux kernel/2.6.36-rc3
• vendor/opensuse
• canonical/opensuse
• version/opensuse/11.1
• vendor/suse
• canonical/suse linux enterprise desktop with beagle
• version/suse linux enterprise desktop with beagle/11-sp1
• canonical/suse linux enterprise real time extension
• version/suse linux enterprise real time extension/11-sp1
• canonical/suse linux enterprise server
• version/suse linux enterprise server/11-sp1
• vendor/canonical
• canonical/ubuntu linux
• version/ubuntu linux/6.06
• version/ubuntu linux/8.04
• version/ubuntu linux/9.04
• version/ubuntu linux/9.10
• version/ubuntu linux/10.04
• version/ubuntu linux/10.10