CWE-415
AllowedDouble Free
Abstraction: Variant · Status: Draft
The product calls free() twice on the same memory address.
1091 vulnerabilities reference this CWE, most recent first.
GHSA-6RRC-7VQP-364C
Vulnerability from github – Published: 2022-01-27 00:01 – Updated: 2025-10-22 00:32A double free bug in packet_set_ring() in net/packet/af_packet.c can be exploited by a local user through crafted syscalls to escalate privileges or deny service. We recommend upgrading kernel past the effected versions or rebuilding past ec6af094ea28f0f2dda1a6a33b14cd57e36a9755
{
"affected": [],
"aliases": [
"CVE-2021-22600"
],
"database_specific": {
"cwe_ids": [
"CWE-415"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-01-26T14:15:00Z",
"severity": "HIGH"
},
"details": "A double free bug in packet_set_ring() in net/packet/af_packet.c can be exploited by a local user through crafted syscalls to escalate privileges or deny service. We recommend upgrading kernel past the effected versions or rebuilding past ec6af094ea28f0f2dda1a6a33b14cd57e36a9755",
"id": "GHSA-6rrc-7vqp-364c",
"modified": "2025-10-22T00:32:28Z",
"published": "2022-01-27T00:01:13Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-22600"
},
{
"type": "WEB",
"url": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit?id=ec6af094ea28f0f2dda1a6a33b14cd57e36a9755"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2022/03/msg00012.html"
},
{
"type": "WEB",
"url": "https://security.netapp.com/advisory/ntap-20230110-0002"
},
{
"type": "WEB",
"url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-22600"
},
{
"type": "WEB",
"url": "https://www.debian.org/security/2022/dsa-5096"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-6XQC-J72Q-X4C8
Vulnerability from github – Published: 2026-05-06 12:30 – Updated: 2026-06-30 03:36In the Linux kernel, the following vulnerability has been resolved:
procfs: fix possible double mmput() in do_procmap_query()
When user provides incorrectly sized buffer for build ID for PROCMAP_QUERY we return with -ENAMETOOLONG error. After recent changes this condition happens later, after we unlocked mmap_lock/per-VMA lock and did mmput(), so original goto out is now wrong and will double-mmput() mm_struct. Fix by jumping further to clean up only vm_file and name_buf.
{
"affected": [],
"aliases": [
"CVE-2026-43178"
],
"database_specific": {
"cwe_ids": [
"CWE-1341",
"CWE-415"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-05-06T12:16:36Z",
"severity": "HIGH"
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nprocfs: fix possible double mmput() in do_procmap_query()\n\nWhen user provides incorrectly sized buffer for build ID for PROCMAP_QUERY\nwe return with -ENAMETOOLONG error. After recent changes this condition\nhappens later, after we unlocked mmap_lock/per-VMA lock and did mmput(),\nso original goto out is now wrong and will double-mmput() mm_struct. Fix\nby jumping further to clean up only vm_file and name_buf.",
"id": "GHSA-6xqc-j72q-x4c8",
"modified": "2026-06-30T03:36:32Z",
"published": "2026-05-06T12:30:31Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-43178"
},
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2026-43178"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467227"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/61dc9f776705d6db6847c101b98fa4f0e9eb6fa3"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/8adaff87db143583e08eec4f4e7788f1ef8af94d"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/90f5e87c9b75833b9ef3a4415b92c0247f28ab2f"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/f9fe092084cd04deea18747f58a2304026e76aaa"
},
{
"type": "WEB",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-43178.json"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-7376-X4RM-3V8X
Vulnerability from github – Published: 2025-06-09 21:30 – Updated: 2026-07-14 15:31A vulnerability has been identified in the libarchive library, specifically within the archive_read_format_rar_seek_data() function. This flaw involves an integer overflow that can ultimately lead to a double-free condition. Exploiting a double-free vulnerability can result in memory corruption, enabling an attacker to execute arbitrary code or cause a denial-of-service condition.
{
"affected": [],
"aliases": [
"CVE-2025-5914"
],
"database_specific": {
"cwe_ids": [
"CWE-190",
"CWE-415"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-06-09T20:15:26Z",
"severity": "LOW"
},
"details": "A vulnerability has been identified in the libarchive library, specifically within the archive_read_format_rar_seek_data() function. This flaw involves an integer overflow that can ultimately lead to a double-free condition. Exploiting a double-free vulnerability can result in memory corruption, enabling an attacker to execute arbitrary code or cause a denial-of-service condition.",
"id": "GHSA-7376-x4rm-3v8x",
"modified": "2026-07-14T15:31:23Z",
"published": "2025-06-09T21:30:52Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-5914"
},
{
"type": "WEB",
"url": "https://github.com/libarchive/libarchive/pull/2598"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2025:16524"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2025:18217"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2025:18218"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2025:18219"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2025:19041"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2025:19046"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2025:21885"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2025:21913"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:0326"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:0934"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:1541"
},
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2025-5914"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2370861"
},
{
"type": "WEB",
"url": "https://cert-portal.siemens.com/productcert/html/ssa-585531.html"
},
{
"type": "WEB",
"url": "https://github.com/libarchive/libarchive/releases/tag/v3.8.0"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2025:14130"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2025:14135"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2025:14137"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2025:14141"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2025:14142"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2025:14525"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2025:14528"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2025:14594"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2025:14644"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2025:14808"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2025:14810"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2025:14828"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2025:15024"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2025:15397"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2025:15709"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2025:15827"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2025:15828"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-74JP-62V9-RVJF
Vulnerability from github – Published: 2026-05-06 12:30 – Updated: 2026-05-08 15:31In the Linux kernel, the following vulnerability has been resolved:
RDMA/irdma: Fix double free related to rereg_user_mr
If IB_MR_REREG_TRANS is set during rereg_user_mr, the umem will be released and a new one will be allocated in irdma_rereg_mr_trans. If any step of irdma_rereg_mr_trans fails after the new umem is allocated, it releases the umem, but does not set iwmr->region to NULL. The problem is that this failure is propagated to the user, who will then call ibv_dereg_mr (as they should). Then, the dereg_mr path will see a non-NULL umem and attempt to call ib_umem_release again.
Fix this by setting iwmr->region to NULL after ib_umem_release.
Fixed: 5ac388db27c4 ("RDMA/irdma: Add support to re-register a memory region")
{
"affected": [],
"aliases": [
"CVE-2026-43120"
],
"database_specific": {
"cwe_ids": [
"CWE-415"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-05-06T10:16:25Z",
"severity": "HIGH"
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/irdma: Fix double free related to rereg_user_mr\n\nIf IB_MR_REREG_TRANS is set during rereg_user_mr, the\numem will be released and a new one will be allocated\nin irdma_rereg_mr_trans. If any step of irdma_rereg_mr_trans\nfails after the new umem is allocated, it releases the umem,\nbut does not set iwmr-\u003eregion to NULL. The problem is that\nthis failure is propagated to the user, who will then call\nibv_dereg_mr (as they should). Then, the dereg_mr path will\nsee a non-NULL umem and attempt to call ib_umem_release again.\n\nFix this by setting iwmr-\u003eregion to NULL after ib_umem_release.\n\nFixed: 5ac388db27c4 (\"RDMA/irdma: Add support to re-register a memory region\")",
"id": "GHSA-74jp-62v9-rvjf",
"modified": "2026-05-08T15:31:16Z",
"published": "2026-05-06T12:30:28Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-43120"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/0c5d70bcb9d2275a1c8515a924016fcfeb4ab441"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/0f22c32141acdcda266b26cab2b830baf870f3e0"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/29a3edd7004bb635d299fb9bc6f0ea4ef13ed5a2"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/62298a48f8b8788ad8b8464e6ffdf1ddebd2217e"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/66964118f1f50ed85001c8fc9f7ab5bbdd021ee0"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-7594-89X5-4CR4
Vulnerability from github – Published: 2022-05-17 03:03 – Updated: 2025-04-20 03:31Multiple use-after-free and double-free vulnerabilities in gifcolor.c in GIFLIB 5.1.2 have unspecified impact and attack vectors.
{
"affected": [],
"aliases": [
"CVE-2016-3177"
],
"database_specific": {
"cwe_ids": [
"CWE-415"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2017-01-23T21:59:00Z",
"severity": "CRITICAL"
},
"details": "Multiple use-after-free and double-free vulnerabilities in gifcolor.c in GIFLIB 5.1.2 have unspecified impact and attack vectors.",
"id": "GHSA-7594-89x5-4cr4",
"modified": "2025-04-20T03:31:27Z",
"published": "2022-05-17T03:03:05Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2016-3177"
},
{
"type": "WEB",
"url": "https://sourceforge.net/p/giflib/bugs/83"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2016/03/16/12"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-76G6-5V2W-PW2H
Vulnerability from github – Published: 2024-05-21 18:31 – Updated: 2025-01-10 18:31In the Linux kernel, the following vulnerability has been resolved:
vhost-vdpa: fix use after free in vhost_vdpa_probe()
The put_device() calls vhost_vdpa_release_dev() which calls ida_simple_remove() and frees "v". So this call to ida_simple_remove() is a use after free and a double free.
{
"affected": [],
"aliases": [
"CVE-2023-52795"
],
"database_specific": {
"cwe_ids": [
"CWE-415"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-05-21T16:15:18Z",
"severity": "HIGH"
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nvhost-vdpa: fix use after free in vhost_vdpa_probe()\n\nThe put_device() calls vhost_vdpa_release_dev() which calls\nida_simple_remove() and frees \"v\". So this call to\nida_simple_remove() is a use after free and a double free.",
"id": "GHSA-76g6-5v2w-pw2h",
"modified": "2025-01-10T18:31:37Z",
"published": "2024-05-21T18:31:21Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-52795"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/ae8ea4e200675a940c365b496ef8e3fb4123601c"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/bf04132cd64ccde4e9e9765d489c83fe83c09b7f"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/c0f8b8fb7df9d1a38652eb5aa817afccd3c56111"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/e07754e0a1ea2d63fb29574253d1fd7405607343"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-76M2-73WX-8HJ7
Vulnerability from github – Published: 2024-05-22 09:31 – Updated: 2025-01-06 21:30In the Linux kernel, the following vulnerability has been resolved:
regmap: Fix possible double-free in regcache_rbtree_exit()
In regcache_rbtree_insert_to_block(), when 'present' realloc failed, the 'blk' which is supposed to assign to 'rbnode->block' will be freed, so 'rbnode->block' points a freed memory, in the error handling path of regcache_rbtree_init(), 'rbnode->block' will be freed again in regcache_rbtree_exit(), KASAN will report double-free as follows:
BUG: KASAN: double-free or invalid-free in kfree+0xce/0x390 Call Trace: slab_free_freelist_hook+0x10d/0x240 kfree+0xce/0x390 regcache_rbtree_exit+0x15d/0x1a0 regcache_rbtree_init+0x224/0x2c0 regcache_init+0x88d/0x1310 __regmap_init+0x3151/0x4a80 __devm_regmap_init+0x7d/0x100 madera_spi_probe+0x10f/0x333 [madera_spi] spi_probe+0x183/0x210 really_probe+0x285/0xc30
To fix this, moving up the assignment of rbnode->block to immediately after the reallocation has succeeded so that the data structure stays valid even if the second reallocation fails.
{
"affected": [],
"aliases": [
"CVE-2021-47483"
],
"database_specific": {
"cwe_ids": [
"CWE-415"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-05-22T09:15:10Z",
"severity": "HIGH"
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nregmap: Fix possible double-free in regcache_rbtree_exit()\n\nIn regcache_rbtree_insert_to_block(), when \u0027present\u0027 realloc failed,\nthe \u0027blk\u0027 which is supposed to assign to \u0027rbnode-\u003eblock\u0027 will be freed,\nso \u0027rbnode-\u003eblock\u0027 points a freed memory, in the error handling path of\nregcache_rbtree_init(), \u0027rbnode-\u003eblock\u0027 will be freed again in\nregcache_rbtree_exit(), KASAN will report double-free as follows:\n\nBUG: KASAN: double-free or invalid-free in kfree+0xce/0x390\nCall Trace:\n slab_free_freelist_hook+0x10d/0x240\n kfree+0xce/0x390\n regcache_rbtree_exit+0x15d/0x1a0\n regcache_rbtree_init+0x224/0x2c0\n regcache_init+0x88d/0x1310\n __regmap_init+0x3151/0x4a80\n __devm_regmap_init+0x7d/0x100\n madera_spi_probe+0x10f/0x333 [madera_spi]\n spi_probe+0x183/0x210\n really_probe+0x285/0xc30\n\nTo fix this, moving up the assignment of rbnode-\u003eblock to immediately after\nthe reallocation has succeeded so that the data structure stays valid even\nif the second reallocation fails.",
"id": "GHSA-76m2-73wx-8hj7",
"modified": "2025-01-06T21:30:49Z",
"published": "2024-05-22T09:31:46Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47483"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/1cead23c1c0bc766dacb900a3b0269f651ad596f"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/36e911a16b377bde0ad91a8c679069d0d310b1a6"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/3dae1a4eced3ee733d7222e69b8a55caf2d61091"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/50cc1462a668dc62949a1127388bc3af785ce047"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/55e6d8037805b3400096d621091dfbf713f97e83"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/758ced2c3878ff789801e6fee808e185c5cf08d6"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/e72dce9afbdbfa70d9b44f5908a50ff6c4858999"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/fc081477b47dfc3a6cb50a96087fc29674013fc2"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-774V-X675-J22M
Vulnerability from github – Published: 2025-07-08 15:32 – Updated: 2025-07-08 15:32Memory corruption while retrieving the CBOR data from TA.
{
"affected": [],
"aliases": [
"CVE-2025-21432"
],
"database_specific": {
"cwe_ids": [
"CWE-415"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-07-08T13:15:29Z",
"severity": "HIGH"
},
"details": "Memory corruption while retrieving the CBOR data from TA.",
"id": "GHSA-774v-x675-j22m",
"modified": "2025-07-08T15:32:02Z",
"published": "2025-07-08T15:32:02Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-21432"
},
{
"type": "WEB",
"url": "https://docs.qualcomm.com/product/publicresources/securitybulletin/july-2025-bulletin.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-77Q3-4VM7-HR7J
Vulnerability from github – Published: 2026-05-12 18:30 – Updated: 2026-05-12 18:30Double free in Windows Rich Text Edit Control allows an authorized attacker to elevate privileges locally.
{
"affected": [],
"aliases": [
"CVE-2026-32170"
],
"database_specific": {
"cwe_ids": [
"CWE-415"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-05-12T18:16:58Z",
"severity": "MODERATE"
},
"details": "Double free in Windows Rich Text Edit Control allows an authorized attacker to elevate privileges locally.",
"id": "GHSA-77q3-4vm7-hr7j",
"modified": "2026-05-12T18:30:41Z",
"published": "2026-05-12T18:30:41Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32170"
},
{
"type": "WEB",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32170"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-7864-H326-5M8J
Vulnerability from github – Published: 2022-05-24 17:44 – Updated: 2022-05-24 17:44In sdp_copy_raw_data of sdp_discovery.cc, there is a possible system compromise due to a double free. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11 Android-8.1 Android-9 Android-10Android ID: A-174052148
{
"affected": [],
"aliases": [
"CVE-2021-0397"
],
"database_specific": {
"cwe_ids": [
"CWE-415"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-03-10T16:15:00Z",
"severity": "CRITICAL"
},
"details": "In sdp_copy_raw_data of sdp_discovery.cc, there is a possible system compromise due to a double free. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11 Android-8.1 Android-9 Android-10Android ID: A-174052148",
"id": "GHSA-7864-h326-5m8j",
"modified": "2022-05-24T17:44:09Z",
"published": "2022-05-24T17:44:09Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-0397"
},
{
"type": "WEB",
"url": "https://source.android.com/security/bulletin/2021-03-01"
}
],
"schema_version": "1.4.0",
"severity": []
}
Mitigation
Choose a language that provides automatic memory management.
Mitigation
Ensure that each allocation is freed only once. After freeing a chunk, set the pointer to NULL to ensure the pointer cannot be freed again. In complicated error conditions, be sure that clean-up routines respect the state of allocation properly. If the language is object oriented, ensure that object destructors delete each chunk of memory only once.
Mitigation
Use a static analysis tool to find double free instances.
No CAPEC attack patterns related to this CWE.