Description
In the Linux kernel, the following vulnerability has been resolved: selinux: fix double free of cond_list on error paths On error path from cond_read_list() and duplicate_policydb_cond_list() the cond_list_destroy() gets called a second time in caller functions, resulting in NULL pointer deref. Fix this by resetting the cond_list_len to 0 in cond_list_destroy(), making subsequent calls a noop. Also consistently reset the cond_list pointer to NULL after freeing. [PM: fix line lengths in the description]
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
60abd3181db29ea81742106cc0ac2e27fd05b418 to < f446089a268c8fc6908488e991d28a9b936293dbaffected60abd3181db29ea81742106cc0ac2e27fd05b418 to < 70caa32e6d81f45f0702070c0e4dfe945e92fbd7affected60abd3181db29ea81742106cc0ac2e27fd05b418 to < 7ed9cbf7ac0d4ed86b356e1b944304ae9ee450d4affected60abd3181db29ea81742106cc0ac2e27fd05b418 to < 186edf7e368c40d06cf727a1ad14698ea67b74adaffected
Linux Linux
Default version status: affected
5.7affected0 to < 5.7unaffected5.10.99 to ≤ 5.10.*unaffected5.15.22 to ≤ 5.15.*unaffected5.16.8 to ≤ 5.16.*unaffected5.17 to ≤ *unaffected