CyberSecBulletin
CVE-2022-48988NVD status: Modified

Linux: Use After Free

Published Updated By the CyberSecBulletin desk

CVE-2022-48988 is a high-severity use after free vulnerability in Linux, with a CVSS 3.1 base score of 7.0 out of 10. It can be exploited with local access to the system by an attacker with a low-privileged account, without any action from a user. The record lists versions b77600e26fd48727a95ffd50ba1e937efb548125, e1ae97624ecf400ea56c238bff23e5cd139df0b8, 35963b31821920908e397146502066f6b032c917 as the first without the flaw, so updating Linux to one of those releases or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 0.24% chance of exploitation within 30 days, which is low compared with other CVEs.

Next patch cycle

High severity with no evidence of exploitation so far.

What to do

  1. Update Linux to b77600e26fd48727a95ffd50ba1e937efb548125 or e1ae97624ecf400ea56c238bff23e5cd139df0b8 or 35963b31821920908e397146502066f6b032c917 or f1f7f36cf682fa59db15e2089039a2eeb58ff2ad, whichever matches your release line, or a later version.
  2. Update Linux Kernel to 4.14.302 or 4.19.269 or 5.4.227 or 5.10.159, whichever matches your release line, or a later version.

Affected products and versions

VendorProductAffected versionsFixed in
LinuxLinux347c4a8747104a945ecced358944e42879176ca5 up to, but not including, b77600e26fd48727a95ffd50ba1e937efb548125; 347c4a8747104a945ecced358944e42879176ca5 up to, but not including, e1ae97624ecf400ea56c238bff23e5cd139df0b8; 347c4a8747104a945ecced358944e42879176ca5 up to, but not including, 35963b31821920908e397146502066f6b032c917; 347c4a8747104a945ecced358944e42879176ca5 up to, but not including, f1f7f36cf682fa59db15e2089039a2eeb58ff2ad; 347c4a8747104a945ecced358944e42879176ca5 up to, but not including, aad8bbd17a1d586005feb9226c2e9cfce1432e13; 347c4a8747104a945ecced358944e42879176ca5 up to, but not including, 0ed074317b835caa6c03bcfa8f133365324673dc; 347c4a8747104a945ecced358944e42879176ca5 up to, but not including, 4a7ba45b1a435e7097ca0f79a847d0949d0eb088; 3.14b77600e26fd48727a95ffd50ba1e937efb548125, e1ae97624ecf400ea56c238bff23e5cd139df0b8, 35963b31821920908e397146502066f6b032c917, f1f7f36cf682fa59db15e2089039a2eeb58ff2ad, aad8bbd17a1d586005feb9226c2e9cfce1432e13, 0ed074317b835caa6c03bcfa8f133365324673dc
LinuxLinux Kernel3.14 up to, but not including, 4.14.302; 4.15 up to, but not including, 4.19.269; 4.20 up to, but not including, 5.4.227; 5.5 up to, but not including, 5.10.159; 5.11 up to, but not including, 5.15.83; 5.16 up to, but not including, 6.0.13; 6.14.14.302, 4.19.269, 5.4.227, 5.10.159, 5.15.83, 6.0.13

Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.

How the severity score breaks down

Attack vector
LocalThe attacker needs local access or must trick a user into running something.
Attack complexity
HighSuccess depends on conditions outside the attacker's control.
Privileges required
LowA basic user account is enough.
User interaction
NoneNo action by a victim is required.
Scope
UnchangedImpact stays within the vulnerable component.
Confidentiality
HighAll data handled by the component can be read.
Integrity
HighData or code can be modified at will.
Availability
HighThe component can be taken down completely.

Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H. Scored by NVD.

Scoring systemScoreSeverityScored by
CVSS 3.17.8HighCNA
CVSS 3.17.0HighNVD

Official description

In the Linux kernel, the following vulnerability has been resolved: memcg: fix possible use-after-free in memcg_write_event_control() memcg_write_event_control() accesses the dentry->d_name of the specified control fd to route the write call. As a cgroup interface file can't be renamed, it's safe to access d_name as long as the specified file is a regular cgroup file. Also, as these cgroup interface files can't be removed before the directory, it's safe to access the parent too. Prior to 347c4a874710 ("memcg: remove cgroup_event->cft"), there was a call to __file_cft() which verified that the specified file is a regular cgroupfs file before further accesses. The cftype pointer returned from __file_cft() was no longer necessary and the commit inadvertently dropped the file type check with it allowing any file to slip through. With the invarients broken, the d_name and parent accesses can now race against renames and removals of arbitrary files and cause use-after-free's. Fix the bug by resurrecting the file type check in __file_cft(). Now that cgroupfs is implemented through kernfs, checking the file operations needs to go through a layer of indirection. Instead, let's check the superblock and dentry type.

Source: the CVE record as published by its numbering authority, via NVD and CVE.org.

The underlying weakness: Use After Free

The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory belongs to the code that operates on the new pointer.

How developers prevent this class of flaw

  • Choose a language that provides automatic memory management.
  • When freeing pointers, be sure to set them to NULL once they are freed. However, the utilization of multiple or complex data structures may lower the usefulness of this strategy.

More Use After Free vulnerabilities (CWE-416)

Timeline

  1. CVE record published.
  2. CISA published its SSVC assessment (exploitation: none, automatable: no, technical impact: partial).
  3. Record last changed materially (score, affected products, status or references).

References

Recent Use After Free vulnerabilities

Spotted an error? Tell us.