Linux: Use After Free
CVE-2022-48787 is a high-severity use after free vulnerability in Linux, with a CVSS 3.1 base score of 7.8 out of 10. It can be exploited with local access to the system by an attacker with a low-privileged account, without any action from a user. The record lists versions d3b98fe36f8a06ce654049540773256ab59cb53d, 7d6475179b85a83186ccce59cdc359d4f07d0bcb, 494de920d98f125b099f27a2d274850750aff957 as the first without the flaw, so updating Linux to one of those releases or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 0.24% chance of exploitation within 30 days, which is low compared with other CVEs.
High severity with no evidence of exploitation so far.
What to do
- Update Linux to d3b98fe36f8a06ce654049540773256ab59cb53d or 7d6475179b85a83186ccce59cdc359d4f07d0bcb or 494de920d98f125b099f27a2d274850750aff957 or 008508c16af0087cda0394e1ac6f0493b01b6063, whichever matches your release line, or a later version.
- Update Linux Kernel to 4.14.268 or 4.19.231 or 5.4.181 or 5.10.102, whichever matches your release line, or a later version.
Affected products and versions
| Vendor | Product | Affected versions | Fixed in |
|---|---|---|---|
| Linux | Linux | 8e10749fa1a454c1e7214f36cec83241f5a36ef1 up to, but not including, d3b98fe36f8a06ce654049540773256ab59cb53d; 1d7cc54137a4f28506dc7beac235b240b08f4e59 up to, but not including, 7d6475179b85a83186ccce59cdc359d4f07d0bcb; 0446cafa843e6db4982731c167e11c80d42be7e2 up to, but not including, 494de920d98f125b099f27a2d274850750aff957; febab6b60d61d13cd9f30a2991deea56df39567d up to, but not including, 008508c16af0087cda0394e1ac6f0493b01b6063; e23f075d77987de4215c8e0696f28bcc707506f7 up to, but not including, ddd46059f7d99119b62d44c519df7a79f2e6a515; 6b5ad4bd0d78fef6bbe0ecdf96e09237c9c52cc1 up to, but not including, 9958b9cbb22145295ee1ffaea0904c383da2c05d; ab07506b0454bea606095951e19e72c282bfbb42 up to, but not including, bea2662e7818e15d7607d17d57912ac984275d94; 4.14.263 up to, but not including, 4.14.268; and 5 more ranges | d3b98fe36f8a06ce654049540773256ab59cb53d, 7d6475179b85a83186ccce59cdc359d4f07d0bcb, 494de920d98f125b099f27a2d274850750aff957, 008508c16af0087cda0394e1ac6f0493b01b6063, ddd46059f7d99119b62d44c519df7a79f2e6a515, 9958b9cbb22145295ee1ffaea0904c383da2c05d |
| Linux | Linux Kernel | 4.14.263 up to, but not including, 4.14.268; 4.19.226 up to, but not including, 4.19.231; 5.4.174 up to, but not including, 5.4.181; 5.10.94 up to, but not including, 5.10.102; 5.15.17 up to, but not including, 5.15.25; 5.16.3 up to, but not including, 5.16.11 | 4.14.268, 4.19.231, 5.4.181, 5.10.102, 5.15.25, 5.16.11 |
Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.
How the severity score breaks down
- Attack vector
- LocalThe attacker needs local access or must trick a user into running something.
- Attack complexity
- LowNo special conditions are needed; the attack works reliably.
- Privileges required
- LowA basic user account is enough.
- User interaction
- NoneNo action by a victim is required.
- Scope
- UnchangedImpact stays within the vulnerable component.
- Confidentiality
- HighAll data handled by the component can be read.
- Integrity
- HighData or code can be modified at will.
- Availability
- HighThe component can be taken down completely.
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. Scored by NVD.
| Scoring system | Score | Severity | Scored by |
|---|---|---|---|
| CVSS 3.1 | 7.8 | High | CNA |
| CVSS 3.1 | 7.8 | High | NVD |
Official description
In the Linux kernel, the following vulnerability has been resolved: iwlwifi: fix use-after-free If no firmware was present at all (or, presumably, all of the firmware files failed to parse), we end up unbinding by calling device_release_driver(), which calls remove(), which then in iwlwifi calls iwl_drv_stop(), freeing the 'drv' struct. However the new code I added will still erroneously access it after it was freed. Set 'failure=false' in this case to avoid the access, all data was already freed anyway.
Source: the CVE record as published by its numbering authority, via NVD and CVE.org.
The underlying weakness: Use After Free
The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory belongs to the code that operates on the new pointer.
How developers prevent this class of flaw
- Choose a language that provides automatic memory management.
- When freeing pointers, be sure to set them to NULL once they are freed. However, the utilization of multiple or complex data structures may lower the usefulness of this strategy.
Timeline
- CVE record published.
- CISA published its SSVC assessment (exploitation: none, automatable: no, technical impact: partial).
- Record last changed materially (score, affected products, status or references).
References
Patches and release notes
- git.kernel.org/stable/c/008508c16af0087cda0394e1ac6f0493b01b6063
- git.kernel.org/stable/c/494de920d98f125b099f27a2d274850750aff957
- git.kernel.org/stable/c/7d6475179b85a83186ccce59cdc359d4f07d0bcb
- git.kernel.org/stable/c/9958b9cbb22145295ee1ffaea0904c383da2c05d
- git.kernel.org/stable/c/bea2662e7818e15d7607d17d57912ac984275d94
- git.kernel.org/stable/c/d3b98fe36f8a06ce654049540773256ab59cb53d
- git.kernel.org/stable/c/ddd46059f7d99119b62d44c519df7a79f2e6a515
Recent Use After Free vulnerabilities
- 8.8 High severity
- 8.8 High severity
- 8.8 High severity
- 8.8 High severity
- 8.8 High severity
- 8.8 High severity
Spotted an error? Tell us.