Executive brief
The Linux kernel's IPComp (IP Payload Compression Protocol) component fails to properly clean up memory references when buffer allocation fails, leaving stale pointers that cause invalid memory access when cleanup functions run. This can lead to kernel crashes and system instability when the affected code path is triggered.
Technical details
The vulnerability exists in the IPComp implementation where ipcomp_scratches holds a pointer to pre-allocated per-CPU buffers. When ipcomp_alloc_scratches() fails to allocate memory, it returns NULL but fails to update the global ipcomp_scratches pointer, which retains a stale reference to a previously freed memory area. Subsequently, when ipcomp_free_scratches() is called, it attempts to free the non-existent memory region via vfree(), causing kernel warnings and potential system instability. The fix is a one-line change ensuring ipcomp_scratches is set to NULL after proper cleanup. No special privileges are required to trigger this via memory pressure or craft conditions affecting buffer allocation.
Affected products
- Linux Linux Kernel Multiple versions from 2.6.11 through 6.x (prior to fix commit 8a04d2fc700f717104bfb95b0f6694e448a4537f)
Timeline
- 2022-10-26: disclosed
- 2022-10-26: patched