Linux: Use After Free
CVE-2022-49014 is a high-severity use after free vulnerability in Linux, with a CVSS 3.1 base score of 7.8 out of 10. It can be exploited with local access to the system by an attacker with a low-privileged account, without any action from a user. The record lists versions 1f23f1890d91812c35d32eab1b49621b6d32dc7b, 16c244bc65d1175775325ec0489a5a5c830e02c7, 5f442e1d403e0496bacb74a58e2be7f500695e6f as the first without the flaw, so updating Linux to one of those releases or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 0.26% chance of exploitation within 30 days, which is low compared with other CVEs.
High severity with no evidence of exploitation so far.
What to do
- Update Linux to 1f23f1890d91812c35d32eab1b49621b6d32dc7b or 16c244bc65d1175775325ec0489a5a5c830e02c7 or 5f442e1d403e0496bacb74a58e2be7f500695e6f or 04b995e963229501401810dab89dc73e7f12d054, whichever matches your release line, or a later version.
- Update Linux Kernel to 4.19.268 or 5.4.226 or 5.10.158 or 5.15.82, whichever matches your release line, or a later version.
Affected products and versions
| Vendor | Product | Affected versions | Fixed in |
|---|---|---|---|
| Linux | Linux | 83c1f36f9880814b24cdf6c2f91f66f61db65326 up to, but not including, 1f23f1890d91812c35d32eab1b49621b6d32dc7b; 83c1f36f9880814b24cdf6c2f91f66f61db65326 up to, but not including, 16c244bc65d1175775325ec0489a5a5c830e02c7; 83c1f36f9880814b24cdf6c2f91f66f61db65326 up to, but not including, 5f442e1d403e0496bacb74a58e2be7f500695e6f; 83c1f36f9880814b24cdf6c2f91f66f61db65326 up to, but not including, 04b995e963229501401810dab89dc73e7f12d054; 83c1f36f9880814b24cdf6c2f91f66f61db65326 up to, but not including, 4cde8da2d814a3b7b176db81922d4ddaad7c0f0e; 83c1f36f9880814b24cdf6c2f91f66f61db65326 up to, but not including, 5daadc86f27ea4d691e2131c04310d0418c6cd12; 4.17 | 1f23f1890d91812c35d32eab1b49621b6d32dc7b, 16c244bc65d1175775325ec0489a5a5c830e02c7, 5f442e1d403e0496bacb74a58e2be7f500695e6f, 04b995e963229501401810dab89dc73e7f12d054, 4cde8da2d814a3b7b176db81922d4ddaad7c0f0e, 5daadc86f27ea4d691e2131c04310d0418c6cd12 |
| Linux | Linux Kernel | 4.17 up to, but not including, 4.19.268; 4.20 up to, but not including, 5.4.226; 5.5 up to, but not including, 5.10.158; 5.11 up to, but not including, 5.15.82; 5.16 up to, but not including, 6.0.12; 6.1 | 4.19.268, 5.4.226, 5.10.158, 5.15.82, 6.0.12 |
Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.
How the severity score breaks down
- Attack vector
- LocalThe attacker needs local access or must trick a user into running something.
- Attack complexity
- LowNo special conditions are needed; the attack works reliably.
- Privileges required
- LowA basic user account is enough.
- User interaction
- NoneNo action by a victim is required.
- Scope
- UnchangedImpact stays within the vulnerable component.
- Confidentiality
- HighAll data handled by the component can be read.
- Integrity
- HighData or code can be modified at will.
- Availability
- HighThe component can be taken down completely.
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. Scored by NVD.
| Scoring system | Score | Severity | Scored by |
|---|---|---|---|
| CVSS 3.1 | 7.8 | High | CNA |
| CVSS 3.1 | 7.8 | High | NVD |
Official description
In the Linux kernel, the following vulnerability has been resolved: net: tun: Fix use-after-free in tun_detach() syzbot reported use-after-free in tun_detach() [1]. This causes call trace like below: ================================================================== BUG: KASAN: use-after-free in notifier_call_chain+0x1ee/0x200 kernel/notifier.c:75 Read of size 8 at addr ffff88807324e2a8 by task syz-executor.0/3673 CPU: 0 PID: 3673 Comm: syz-executor.0 Not tainted 6.1.0-rc5-syzkaller-00044-gcc675d22e422 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022 Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0xd1/0x138 lib/dump_stack.c:106 print_address_description mm/kasan/report.c:284 [inline] print_report+0x15e/0x461 mm/kasan/report.c:395 kasan_report+0xbf/0x1f0 mm/kasan/report.c:495 notifier_call_chain+0x1ee/0x200 kernel/notifier.c:75 call_netdevice_notifiers_info+0x86/0x130 net/core/dev.c:1942 call_netdevice_notifiers_extack net/core/dev.c:1983 [inline] call_netdevice_notifiers net/core/dev.c:1997 [inline] netdev_wait_allrefs_any net/core/dev.c:10237 [inline] netdev_run_todo+0xbc6/0x1100 net/core/dev.c:10351 tun_detach drivers/net/tun.c:704 [inline] tun_chr_close+0xe4/0x190 drivers/net/tun.c:3467 __fput+0x27c/0xa90 fs/file_table.c:320 task_work_run+0x16f/0x270 kernel/task_work.c:179 exit_task_work include/linux/task_work.h:38 [inline] do_exit+0xb3d/0x2a30 kernel/exit.c:820 do_group_exit+0xd4/0x2a0 kernel/exit.c:950 get_signal+0x21b1/0x2440 kernel/signal.c:2858 arch_do_signal_or_restart+0x86/0x2300 arch/x86/kernel/signal.c:869 exit_to_user_mode_loop kernel/entry/common.c:168 [inline] exit_to_user_mode_prepare+0x15f/0x250 kernel/entry/common.c:203 __syscall_exit_to_user_mode_work kernel/entry/common.c:285 [inline] syscall_exit_to_user_mode+0x1d/0x50 kernel/entry/common.c:296 do_syscall_64+0x46/0xb0 arch/x86/entry/common.c:86 entry_SYSCALL_64_after_hwframe+0x63/0xcd The cause of the issue is that sock_put() from __tun_detach() drops last reference count for struct net, and then notifier_call_chain() from netdev_state_change() accesses that struct net. This patch fixes the issue by calling sock_put() from tun_detach() after all necessary accesses for the struct net has done.
Source: the CVE record as published by its numbering authority, via NVD and CVE.org.
The underlying weakness: Use After Free
The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory belongs to the code that operates on the new pointer.
How developers prevent this class of flaw
- Choose a language that provides automatic memory management.
- When freeing pointers, be sure to set them to NULL once they are freed. However, the utilization of multiple or complex data structures may lower the usefulness of this strategy.
Timeline
- CVE record published.
- CISA published its SSVC assessment (exploitation: none, automatable: no, technical impact: partial).
- Record last changed materially (score, affected products, status or references).
References
Patches and release notes
- git.kernel.org/stable/c/04b995e963229501401810dab89dc73e7f12d054
- git.kernel.org/stable/c/16c244bc65d1175775325ec0489a5a5c830e02c7
- git.kernel.org/stable/c/1f23f1890d91812c35d32eab1b49621b6d32dc7b
- git.kernel.org/stable/c/4cde8da2d814a3b7b176db81922d4ddaad7c0f0e
- git.kernel.org/stable/c/5daadc86f27ea4d691e2131c04310d0418c6cd12
- git.kernel.org/stable/c/5f442e1d403e0496bacb74a58e2be7f500695e6f
Recent Use After Free vulnerabilities
- 7.0 High severity
- 7.0 High severity
- 7.8 High severity
- 7.8 High severity
- 7.8 High severity
- 7.8 High severity
Spotted an error? Tell us.