CVE-2024-50088

btrfs: fix uninitialized pointer free in add_inode_ref()

High · published October 29, 2024

CVSS v3.1
7.8
EPSS
0%
Percentile
11.2
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

btrfs: fix uninitialized pointer free in add_inode_ref()

The add_inode_ref() function does not initialize the "name" struct when

it is declared. If any of the following calls to "read_one_inode()

returns NULL,

dir = read_one_inode(root, parent_objectid);

if (!dir) {

ret = -ENOENT;

goto out;

}

inode = read_one_inode(root, inode_objectid);

if (!inode) {

ret = -EIO;

goto out;

}

then "name.name" would be freed on "out" before being initialized.

out:

...

kfree(name.name);

This issue was reported by Coverity with CID 1526744.

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00214 · 11.2th percentile
Published
2024-10-29T00:50Z
EPSS history
Timeline
  • 29 OCT 00:50Z
    btrfs: fix uninitialized pointer free in add_inode_ref()
    cvelistv5