Executive Summary

This vulnerability is a double free issue in the Linux kernel's crypto subsystem for aspeed devices. It occurs because the clock obtained via devm_clk_get_enabled() is automatically managed and freed by the device resource management system (devres). However, the code manually calls clk_disable_unprepare() during error handling and removal, which leads to the clock being freed twice, causing a double free vulnerability.

Useful 0 Not Useful 0

Impact Analysis

The double free vulnerability can lead to undefined behavior such as kernel crashes or memory corruption, potentially causing system instability or denial of service. It may also be exploitable by attackers to escalate privileges or execute arbitrary code within the kernel.

Useful 0 Not Useful 0

Mitigation Strategies

Update the Linux kernel to a version where the double free issue in the aspeed crypto driver has been fixed. Specifically, ensure that the manual clock cleanup calls in aspeed_acry_probe() error path and aspeed_acry_remove() are removed, as per the patch that resolves this vulnerability.

Useful 0 Not Useful 0