Double-Free Vulnerability in Linux Kernel JFS by Google

CVE-2023-53616

What is CVE-2023-53616?

A critical flaw in the Linux kernel's JFS (Journaled File System) involves improper handling of memory management during the unmounting process. Specifically, the issue arises from an invalid free operation that can lead to a double-free condition when the system attempts to free an already released memory address. This occurs if the function responsible for unmounting does not properly nullify the memory reference after it has been freed. As a result, if the remount operation fails after freeing the memory, it can inadvertently lead to another attempt to free the same memory, causing serious stability and security implications for applications running on Google Compute Engine. The vulnerability has been addressed by ensuring that memory pointers are correctly nulled after their corresponding allocation is freed.

References