Executive Summary

This vulnerability exists in the Linux kernel's hns3 network driver, specifically in the function hns3_set_ringparam(). A temporary copy of the ring structure is created for rollback purposes, but the tx_spare pointer in the original ring structure incorrectly continues to point to old backup memory.

If memory allocation fails later during the setup in hns3_init_all_ring(), the error handling code attempts to free all newly allocated rings. Because tx_spare still points to the old backup memory (a stale pointer), it is mistakenly freed again, causing a double-free of the backup memory.

The root cause is that the tx_spare pointer was not cleared (set to NULL) after its value was saved in the temporary copy, leaving a dangling pointer that leads to erroneous double freeing.

The fix involves setting tx_spare to NULL in the original ring structure when the creation of a new tx_spare fails, ensuring that only genuinely newly allocated buffers are freed during error cleanup.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to a double-free condition in the Linux kernel's network driver, which may cause system instability, crashes, or potentially allow an attacker to execute arbitrary code or escalate privileges by exploiting memory corruption.

Because the double-free occurs in kernel memory management, it can compromise the reliability and security of the affected system, potentially leading to denial of service or other security breaches.

Useful 0 Not Useful 0

Mitigation Strategies

The vulnerability is fixed by ensuring that the tx_spare pointer is set to NULL after its value is saved in the temporary ring structure, preventing a double-free error.

To mitigate this vulnerability, you should update your Linux kernel to a version that includes this fix for the hns3 driver.

Useful 0 Not Useful 0