Linux: Use After Free
CVE-2022-49087 is a high-severity use after free vulnerability in Linux, with a CVSS 3.1 base score of 7.8 out of 10. It can be exploited with local access to the system by an attacker with a low-privileged account, without any action from a user. The record lists versions 864297ee30727ae6233f80296b7fc91442620b05, 7ee84d29f22de6f6c63fad6c54690517659862f1, 08ff0e74fab517dbc44e11b8bc683dd4ecc65950 as the first without the flaw, so updating Linux to one of those releases or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 0.25% chance of exploitation within 30 days, which is low compared with other CVEs.
High severity with no evidence of exploitation so far.
What to do
- Update Linux to 864297ee30727ae6233f80296b7fc91442620b05 or 7ee84d29f22de6f6c63fad6c54690517659862f1 or 08ff0e74fab517dbc44e11b8bc683dd4ecc65950 or 571d8e1d154ca18f08dcb72b69318d36e10010a0, whichever matches your release line, or a later version.
- Update Linux Kernel to 4.19.238 or 5.4.189 or 5.10.111 or 5.15.34, whichever matches your release line, or a later version.
Affected products and versions
| Vendor | Product | Affected versions | Fixed in |
|---|---|---|---|
| Linux | Linux | ace45bec6d77bc061c3c3d8ad99e298ea9800c2b up to, but not including, 864297ee30727ae6233f80296b7fc91442620b05; ace45bec6d77bc061c3c3d8ad99e298ea9800c2b up to, but not including, 7ee84d29f22de6f6c63fad6c54690517659862f1; ace45bec6d77bc061c3c3d8ad99e298ea9800c2b up to, but not including, 08ff0e74fab517dbc44e11b8bc683dd4ecc65950; ace45bec6d77bc061c3c3d8ad99e298ea9800c2b up to, but not including, 571d8e1d154ca18f08dcb72b69318d36e10010a0; ace45bec6d77bc061c3c3d8ad99e298ea9800c2b up to, but not including, 41024a40f6c793abbb916a857f18fb009f07464c; ace45bec6d77bc061c3c3d8ad99e298ea9800c2b up to, but not including, cd8aef1f30d1215648e4e6686cfb422004851429; ace45bec6d77bc061c3c3d8ad99e298ea9800c2b up to, but not including, 1946014ca3b19be9e485e780e862c375c6f98bad; 4.17 | 864297ee30727ae6233f80296b7fc91442620b05, 7ee84d29f22de6f6c63fad6c54690517659862f1, 08ff0e74fab517dbc44e11b8bc683dd4ecc65950, 571d8e1d154ca18f08dcb72b69318d36e10010a0, 41024a40f6c793abbb916a857f18fb009f07464c, cd8aef1f30d1215648e4e6686cfb422004851429 |
| Linux | Linux Kernel | 4.17 up to, but not including, 4.19.238; 4.20 up to, but not including, 5.4.189; 5.5 up to, but not including, 5.10.111; 5.11 up to, but not including, 5.15.34; 5.16 up to, but not including, 5.16.20; 5.17 up to, but not including, 5.17.3; 5.18 | 4.19.238, 5.4.189, 5.10.111, 5.15.34, 5.16.20, 5.17.3 |
Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.
How the severity score breaks down
- Attack vector
- LocalThe attacker needs local access or must trick a user into running something.
- Attack complexity
- LowNo special conditions are needed; the attack works reliably.
- Privileges required
- LowA basic user account is enough.
- User interaction
- NoneNo action by a victim is required.
- Scope
- UnchangedImpact stays within the vulnerable component.
- Confidentiality
- HighAll data handled by the component can be read.
- Integrity
- HighData or code can be modified at will.
- Availability
- HighThe component can be taken down completely.
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. Scored by CISA (ADP).
Official description
In the Linux kernel, the following vulnerability has been resolved: rxrpc: fix a race in rxrpc_exit_net() Current code can lead to the following race: CPU0 CPU1 rxrpc_exit_net() rxrpc_peer_keepalive_worker() if (rxnet->live) rxnet->live = false; del_timer_sync(&rxnet->peer_keepalive_timer); timer_reduce(&rxnet->peer_keepalive_timer, jiffies + delay); cancel_work_sync(&rxnet->peer_keepalive_work); rxrpc_exit_net() exits while peer_keepalive_timer is still armed, leading to use-after-free. syzbot report was: ODEBUG: free active (active state 0) object type: timer_list hint: rxrpc_peer_keepalive_timeout+0x0/0xb0 WARNING: CPU: 0 PID: 3660 at lib/debugobjects.c:505 debug_print_object+0x16e/0x250 lib/debugobjects.c:505 Modules linked in: CPU: 0 PID: 3660 Comm: kworker/u4:6 Not tainted 5.17.0-syzkaller-13993-g88e6c0207623 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Workqueue: netns cleanup_net RIP: 0010:debug_print_object+0x16e/0x250 lib/debugobjects.c:505 Code: ff df 48 89 fa 48 c1 ea 03 80 3c 02 00 0f 85 af 00 00 00 48 8b 14 dd 00 1c 26 8a 4c 89 ee 48 c7 c7 00 10 26 8a e8 b1 e7 28 05 <0f> 0b 83 05 15 eb c5 09 01 48 83 c4 18 5b 5d 41 5c 41 5d 41 5e c3 RSP: 0018:ffffc9000353fb00 EFLAGS: 00010082 RAX: 0000000000000000 RBX: 0000000000000003 RCX: 0000000000000000 RDX: ffff888029196140 RSI: ffffffff815efad8 RDI: fffff520006a7f52 RBP: 0000000000000001 R08: 0000000000000000 R09: 0000000000000000 R10: ffffffff815ea4ae R11: 0000000000000000 R12: ffffffff89ce23e0 R13: ffffffff8a2614e0 R14: ffffffff816628c0 R15: dffffc0000000000 FS: 0000000000000000(0000) GS:ffff8880b9c00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fe1f2908924 CR3: 0000000043720000 CR4: 00000000003506f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK> __debug_check_no_obj_freed lib/debugobjects.c:992 [inline] debug_check_no_obj_freed+0x301/0x420 lib/debugobjects.c:1023 kfree+0xd6/0x310 mm/slab.c:3809 ops_free_list.part.0+0x119/0x370 net/core/net_namespace.c:176 ops_free_list net/core/net_namespace.c:174 [inline] cleanup_net+0x591/0xb00 net/core/net_namespace.c:598 process_one_work+0x996/0x1610 kernel/workqueue.c:2289 worker_thread+0x665/0x1080 kernel/workqueue.c:2436 kthread+0x2e9/0x3a0 kernel/kthread.c:376 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:298 </TASK>
Source: the CVE record as published by its numbering authority, via NVD and CVE.org.
The underlying weakness: Use After Free
The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory belongs to the code that operates on the new pointer.
How developers prevent this class of flaw
- Choose a language that provides automatic memory management.
- When freeing pointers, be sure to set them to NULL once they are freed. However, the utilization of multiple or complex data structures may lower the usefulness of this strategy.
Timeline
- CVE record published.
- CISA published its SSVC assessment (exploitation: none, automatable: no, technical impact: total).
- Record last changed materially (score, affected products, status or references).
References
Patches and release notes
- git.kernel.org/stable/c/08ff0e74fab517dbc44e11b8bc683dd4ecc65950
- git.kernel.org/stable/c/1946014ca3b19be9e485e780e862c375c6f98bad
- git.kernel.org/stable/c/41024a40f6c793abbb916a857f18fb009f07464c
- git.kernel.org/stable/c/571d8e1d154ca18f08dcb72b69318d36e10010a0
- git.kernel.org/stable/c/7ee84d29f22de6f6c63fad6c54690517659862f1
- git.kernel.org/stable/c/864297ee30727ae6233f80296b7fc91442620b05
- git.kernel.org/stable/c/cd8aef1f30d1215648e4e6686cfb422004851429
Recent Use After Free vulnerabilities
- 7.8 High severity
- 7.8 High severity
- 7.8 High severity
- 7.8 High severity
- 7.8 High severity
- 7.8 High severity
Spotted an error? Tell us.