Tpambor

The Dhara flash translation layer disk driver in `drivers/disk/ftl dhara.c` contains a flaw where `dhara nand ` callbacks write error codes unconditionally to a caller-supplied `dhara error t` `err` pointer. During the journal-resume binary search, the `find last checkblock()` function calls `find checkblock()`, which passes a NULL pointer into `dhara nand read()`. This process occurs during `disk ftl access init()` and `dhara map resume()` when the FTL disk is mounted or initialized. If a flash read error—such as an uncorrectable ECC (Error Correction Code), bad block, or controller error—occurs on a probed checkpoint page, the driver dereferences the NULL pointer, leading to a kernel fault and denial of service. This can be triggered by media wear, induced faults, or a corrupted on-flash image.

A use-after-free read exists in the IPv4 IGMP implementation. The function `igmp send()` in `subsys/net/ip/igmp.c` reads the network interface from a packet using `net pkt iface(pkt)` after the packet has been passed to `net send data()`. In certain configurations, the packet's last reference may be released by the L2 driver or network stack TX handling, returning the memory block to the free list before the read occurs. If `CONFIG NET STATISTICS PER INTERFACE` is enabled, the resulting dangling pointer is dereferenced for a statistics-counter write. This path can be triggered without authentication via inbound IPv4 IGMP membership queries addressed to 224.0.0.1 or through local multicast join, leave, or rejoin operations. This may lead to undefined behavior, sporadic crashes, or denial of service. A similar pattern exists in the IPv6 MLD path within the `mld send()` function in `subsys/net/ip/ipv6 mld.c`.

A use-after-free issue exists in the `mld send()` function within the IPv6 Multicast Listener Discovery (MLD) implementation. The function attempts to read the packet interface using `net pkt iface(pkt)` after `net send data(pkt)` has successfully returned. According to the network stack ownership contract, a successful send operation transfers ownership of the `net pkt`, leading the L2 driver to free it. Consequently, accessing the packet after this call results in a read of a freed object. When `CONFIG NET STATISTICS PER INTERFACE` is enabled, the recovered interface pointer is dereferenced to update statistics. If the memory is concurrently reallocated, this can lead to a NULL-pointer dereference causing a crash or a stray write resulting in memory corruption. This can be triggered remotely without authentication on the local link by sending a valid MLDv2 General Query, which prompts the `handle mld query()` function to call `send mld report()` and subsequently `mld send()`, potentially leading to a denial of service.

A use-after-free issue exists in the native IPv4 stack within the `icmpv4 handle echo request()` function in `subsys/net/ip/icmpv4.c`. The function creates an echo-reply packet and passes it to `net try send data()`, which transfers ownership of the packet to the transmission path. This process can release the packet memory back to its slab via `net pkt unref()` and `k mem slab free()` before the function calls `net stats update icmp sent()` using `net pkt iface(reply)`. Consequently, the system reads the `iface` variable from freed or reallocated memory. When `CONFIG NET STATISTICS PER INTERFACE` is enabled, this can lead to a write operation through a stale pointer. This flaw is reachable unauthenticated by any remote host sending a ping request and is gated by `CONFIG NET STATISTICS ICMP`. The impact includes potential corruption of interface statistics or a remotely triggerable denial-of-service (DoS) crash due to a timing race.