CVE-2023-54050

In the Linux kernel, the following vulnerability has been resolved:

ubifs: Fix memleak when insert_old_idx() failed

Following process will cause a memleak for copied up znode:

dirty_cow_znode zn = copy_znode(c, znode); err = insert_old_idx(c, zbr->lnum, zbr->offs); if (unlikely(err)) return ERR_PTR(err); // No one refers to zn.

Fetch a reproducer in [Link].

Function copy_znode() is split into 2 parts: resource allocation and znode replacement, insert_old_idx() is split in similar way, so resource cleanup could be done in error handling path without corrupting metadata(mem & disk). It's okay that old index inserting is put behind of add_idx_dirt(), old index is used in layout_leb_in_gaps(), so the two processes do not depend on each other.

A low severity memory leak was found in the Linux kernel's UBIFS file system implementation. If insert_old_idx() fails during dirty_cow_znode() processing, the newly copied znode is not referenced by anything and is never freed, so kernel memory is leaked. A local user able to trigger UBIFS copy-on-write index updates on an error path could gradually exhaust kernel memory and degrade system availability. Red Hat Product Security rates this flaw Low impact (CVSS 3.3, AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) because exploitation requires local access and the only impact is a memory leak affecting availability. This is lower than the 7.8 severity assigned by CVE.org, whose CVSS vector assumes high confidentiality and integrity impacts that a memory leak on this error path does not provide. The vulnerable code is not present in the shipped kernels of Red Hat Enterprise Linux 7, 8, 9, and 10 (including kernel-rt) or Red Hat In-Vehicle OS, so those products are not affected. The only remaining affect is the Red Hat Enterprise Linux 6 Extended Lifecycle Support stream, which is out of support scope and will not receive a fix.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.