
12 Oct
2021
12 Oct
'21
10:07 a.m.
Hello U-Boot lists! I had been doing a fuzz testing in U-Boot . There is a double free bug in U-Boot, in /fs/squashfs/sqfs.c in the function sqfs_tokenize( ). On the line 307, tokens[i] is being freed and the ret is being set -ENOMEM, it will go to the out: label and free tokens[i] again (just like CVE-2020-8432, double free in do_rename_gpt_parts() ). Here is a sample command cause to crash in sandbox environment: host bind 0 test.sqsh sqfsls host 0 1//3