Use After Free in Linux Kernel's Kunit Debugging System

CVE-2024-56772

Summary

A vulnerability has been identified in the Linux kernel's Kunit debugging framework, specifically related to memory management. In the function kunit_debugfs_create_suite(), a flaw occurs when the allocation of a string stream fails during the execution of the kunit_suite_for_each_test_case() loop. If this allocation fails, the function does not properly nullify the stream pointer after freeing it. This oversight can lead to a Use After Free scenario, resulting in potential kernel panics or data corruption. The resolution involves modifying the error-handling path to ensure that the stream pointer is set to NULL post-free, mitigating the risk associated with accessing freed memory.

References