Linux: Use After Free
CVE-2022-49349 is a high-severity use after free vulnerability in Linux, with a CVSS 3.1 base score of 7.8 out of 10. It can be exploited with local access to the system by an unauthenticated attacker, but only if a user takes part, for example by opening a link or file. The record lists versions 1a3a15bf6f9963d755270cbdb282863b84839195, 97f802a652a749422dede32071d29a53cf4bd034, 10801095224de0d0ab06ae60698680c1f883a3ae as the first without the flaw, so updating Linux to one of those releases or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 0.29% chance of exploitation within 30 days, which is low compared with other CVEs.
High severity with no evidence of exploitation so far.
What to do
- Update Linux to 1a3a15bf6f9963d755270cbdb282863b84839195 or 97f802a652a749422dede32071d29a53cf4bd034 or 10801095224de0d0ab06ae60698680c1f883a3ae or eaecf7ebfd5dd09038a80b14be46b844f54cfc5c, whichever matches your release line, or a later version.
- Update Linux Kernel to 4.9.318 or 4.14.283 or 4.19.247 or 5.4.198, whichever matches your release line, or a later version.
- Because the attack needs a user to take part, warn users about unexpected links and files related to this product until it is patched.
Affected products and versions
| Vendor | Product | Affected versions | Fixed in |
|---|---|---|---|
| Linux | Linux | 32f7f22c0b52e8189fef83986b16dc7abe95f2c4 up to, but not including, 1a3a15bf6f9963d755270cbdb282863b84839195; 32f7f22c0b52e8189fef83986b16dc7abe95f2c4 up to, but not including, 97f802a652a749422dede32071d29a53cf4bd034; 32f7f22c0b52e8189fef83986b16dc7abe95f2c4 up to, but not including, 10801095224de0d0ab06ae60698680c1f883a3ae; 32f7f22c0b52e8189fef83986b16dc7abe95f2c4 up to, but not including, eaecf7ebfd5dd09038a80b14be46b844f54cfc5c; 32f7f22c0b52e8189fef83986b16dc7abe95f2c4 up to, but not including, dd887f83ea54aea5b780a84527e23ab95f777fed; 32f7f22c0b52e8189fef83986b16dc7abe95f2c4 up to, but not including, 364380c00912bed9b5d99eb485018360b0ecf64f; 32f7f22c0b52e8189fef83986b16dc7abe95f2c4 up to, but not including, 0ff38b99fa075ddd246487a28cb9af049f4ceef1; 32f7f22c0b52e8189fef83986b16dc7abe95f2c4 up to, but not including, 4a2bea60cf7ff957b3eda0b17750d483876a02fa; and 2 more ranges | 1a3a15bf6f9963d755270cbdb282863b84839195, 97f802a652a749422dede32071d29a53cf4bd034, 10801095224de0d0ab06ae60698680c1f883a3ae, eaecf7ebfd5dd09038a80b14be46b844f54cfc5c, dd887f83ea54aea5b780a84527e23ab95f777fed, 364380c00912bed9b5d99eb485018360b0ecf64f |
| Linux | Linux Kernel | before 4.9.318; 4.10 up to, but not including, 4.14.283; 4.15 up to, but not including, 4.19.247; 4.20 up to, but not including, 5.4.198; 5.5 up to, but not including, 5.10.121; 5.11 up to, but not including, 5.15.46; 5.16 up to, but not including, 5.17.14; 5.18 up to, but not including, 5.18.3 | 4.9.318, 4.14.283, 4.19.247, 5.4.198, 5.10.121, 5.15.46 |
Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.
How the severity score breaks down
- Attack vector
- LocalThe attacker needs local access or must trick a user into running something.
- Attack complexity
- LowNo special conditions are needed; the attack works reliably.
- Privileges required
- NoneNo account or login is needed.
- User interaction
- RequiredA user must take an action such as opening a file or link.
- Scope
- UnchangedImpact stays within the vulnerable component.
- Confidentiality
- HighAll data handled by the component can be read.
- Integrity
- HighData or code can be modified at will.
- Availability
- HighThe component can be taken down completely.
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. Scored by CNA.
| Scoring system | Score | Severity | Scored by |
|---|---|---|---|
| CVSS 3.1 | 7.8 | High | CNA |
| CVSS 3.1 | 7.8 | High | CISA (ADP) |
Official description
In the Linux kernel, the following vulnerability has been resolved: ext4: fix use-after-free in ext4_rename_dir_prepare We got issue as follows: EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue ext4_get_first_dir_block: bh->b_data=0xffff88810bee6000 len=34478 ext4_get_first_dir_block: *parent_de=0xffff88810beee6ae bh->b_data=0xffff88810bee6000 ext4_rename_dir_prepare: [1] parent_de=0xffff88810beee6ae ================================================================== BUG: KASAN: use-after-free in ext4_rename_dir_prepare+0x152/0x220 Read of size 4 at addr ffff88810beee6ae by task rep/1895 CPU: 13 PID: 1895 Comm: rep Not tainted 5.10.0+ #241 Call Trace: dump_stack+0xbe/0xf9 print_address_description.constprop.0+0x1e/0x220 kasan_report.cold+0x37/0x7f ext4_rename_dir_prepare+0x152/0x220 ext4_rename+0xf44/0x1ad0 ext4_rename2+0x11c/0x170 vfs_rename+0xa84/0x1440 do_renameat2+0x683/0x8f0 __x64_sys_renameat+0x53/0x60 do_syscall_64+0x33/0x40 entry_SYSCALL_64_after_hwframe+0x44/0xa9 RIP: 0033:0x7f45a6fc41c9 RSP: 002b:00007ffc5a470218 EFLAGS: 00000246 ORIG_RAX: 0000000000000108 RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f45a6fc41c9 RDX: 0000000000000005 RSI: 0000000020000180 RDI: 0000000000000005 RBP: 00007ffc5a470240 R08: 00007ffc5a470160 R09: 0000000020000080 R10: 00000000200001c0 R11: 0000000000000246 R12: 0000000000400bb0 R13: 00007ffc5a470320 R14: 0000000000000000 R15: 0000000000000000 The buggy address belongs to the page: page:00000000440015ce refcount:0 mapcount:0 mapping:0000000000000000 index:0x1 pfn:0x10beee flags: 0x200000000000000() raw: 0200000000000000 ffffea00043ff4c8 ffffea0004325608 0000000000000000 raw: 0000000000000001 0000000000000000 00000000ffffffff 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff88810beee580: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ffff88810beee600: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff >ffff88810beee680: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ^ ffff88810beee700: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ffff88810beee780: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ================================================================== Disabling lock debugging due to kernel taint ext4_rename_dir_prepare: [2] parent_de->inode=3537895424 ext4_rename_dir_prepare: [3] dir=0xffff888124170140 ext4_rename_dir_prepare: [4] ino=2 ext4_rename_dir_prepare: ent->dir->i_ino=2 parent=-757071872 Reason is first directory entry which 'rec_len' is 34478, then will get illegal parent entry. Now, we do not check directory entry after read directory block in 'ext4_get_first_dir_block'. To solve this issue, check directory entry in 'ext4_get_first_dir_block'. [ Trigger an ext4_error() instead of just warning if the directory is missing a '.' or '..' entry. Also make sure we return an error code if the file system is corrupted. -TYT ]
Source: the CVE record as published by its numbering authority, via NVD and CVE.org.
The underlying weakness: Use After Free
The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory belongs to the code that operates on the new pointer.
How developers prevent this class of flaw
- Choose a language that provides automatic memory management.
- When freeing pointers, be sure to set them to NULL once they are freed. However, the utilization of multiple or complex data structures may lower the usefulness of this strategy.
Timeline
- CVE record published.
- CISA published its SSVC assessment (exploitation: none, automatable: no, technical impact: total).
- Record last changed materially (score, affected products, status or references).
References
Patches and release notes
- git.kernel.org/stable/c/0be698ecbe4471fcad80e81ec6a05001421041b3
- git.kernel.org/stable/c/0ff38b99fa075ddd246487a28cb9af049f4ceef1
- git.kernel.org/stable/c/10801095224de0d0ab06ae60698680c1f883a3ae
- git.kernel.org/stable/c/1a3a15bf6f9963d755270cbdb282863b84839195
- git.kernel.org/stable/c/364380c00912bed9b5d99eb485018360b0ecf64f
- git.kernel.org/stable/c/4a2bea60cf7ff957b3eda0b17750d483876a02fa
- git.kernel.org/stable/c/97f802a652a749422dede32071d29a53cf4bd034
- git.kernel.org/stable/c/dd887f83ea54aea5b780a84527e23ab95f777fed
- git.kernel.org/stable/c/eaecf7ebfd5dd09038a80b14be46b844f54cfc5c
Recent Use After Free vulnerabilities
- 7.8 High severity
- 7.8 High severity
- 7.8 High severity
- 7.8 High severity
- 7.8 High severity
- 7.8 High severity
Spotted an error? Tell us.