Description
In the Linux kernel, the following vulnerability has been resolved: SUNRPC: auth_gss: fix memory leaks in XDR decoding error paths The gssx_dec_ctx(), gssx_dec_status(), and gssx_dec_name() functions allocate memory via gssx_dec_buffer(), which calls kmemdup(). When a subsequent decode operation fails, these functions return immediately without freeing previously allocated buffers, causing memory leaks. The leak in gssx_dec_ctx() is particularly relevant because the caller (gssp_accept_sec_context_upcall) initializes several buffer length fields to non-zero values, resulting in memory allocation: struct gssx_ctx rctxh = { .exported_context_token.len = GSSX_max_output_handle_sz, .mech.len = GSS_OID_MAX_LEN, .src_name.display_name.len = GSSX_max_princ_sz, .targ_name.display_name.len = GSSX_max_princ_sz }; If, for example, gssx_dec_name() succeeds for src_name but fails for targ_name, the memory allocated for exported_context_token, mech, and src_name.display_name remains unreferenced and cannot be reclaimed. Add error handling with goto-based cleanup to free any previously allocated buffers before returning an error.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
1d658336b05f8697d6445834f8867f8ad5e4f735 to < c81431b1b9fbd21e9a5a9211b5517b7295d18e6aaffected1d658336b05f8697d6445834f8867f8ad5e4f735 to < caf7eff432e91a9eba1c79fa545c2f54be15d62baffected1d658336b05f8697d6445834f8867f8ad5e4f735 to < 64303b92d94c0c7845a273acd8d84b796d6f1db7affected1d658336b05f8697d6445834f8867f8ad5e4f735 to < df10f23defff22c8d55fe6db74f6e4ce927145bfaffected1d658336b05f8697d6445834f8867f8ad5e4f735 to < b4af3806846778799cd4ab0766dc18341e777264affected1d658336b05f8697d6445834f8867f8ad5e4f735 to < d79b9097a6a2b91471b40755f1225364be5d85ffaffected1d658336b05f8697d6445834f8867f8ad5e4f735 to < 3b56eb90feb8a3709417f5624f3871847d42bcb1affected1d658336b05f8697d6445834f8867f8ad5e4f735 to < 3e6397b056335cc56ef0e9da36c95946a19f5118affected
Linux Linux
Default version status: affected
3.10affected0 to < 3.10unaffected5.10.252 to ≤ 5.10.*unaffected5.15.202 to ≤ 5.15.*unaffected6.1.165 to ≤ 6.1.*unaffected6.6.128 to ≤ 6.6.*unaffected6.12.75 to ≤ 6.12.*unaffected6.18.14 to ≤ 6.18.*unaffected6.19.4 to ≤ 6.19.*unaffected7.0 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/c81431b1b9fbd21e9a5a9211b5517b7295d18e6a ↗
- https://git.kernel.org/stable/c/caf7eff432e91a9eba1c79fa545c2f54be15d62b ↗
- https://git.kernel.org/stable/c/64303b92d94c0c7845a273acd8d84b796d6f1db7 ↗
- https://git.kernel.org/stable/c/df10f23defff22c8d55fe6db74f6e4ce927145bf ↗
- https://git.kernel.org/stable/c/b4af3806846778799cd4ab0766dc18341e777264 ↗
- https://git.kernel.org/stable/c/d79b9097a6a2b91471b40755f1225364be5d85ff ↗
- https://git.kernel.org/stable/c/3b56eb90feb8a3709417f5624f3871847d42bcb1 ↗
- https://git.kernel.org/stable/c/3e6397b056335cc56ef0e9da36c95946a19f5118 ↗