CyberSecBulletin
CVE-2022-49474NVD status: Analyzed

Linux: Use After Free

Published Updated By the CyberSecBulletin desk

CVE-2022-49474 is a high-severity use after free vulnerability in Linux, with a CVSS 3.1 base score of 7.8 out of 10. It can be exploited with local access to the system by an attacker with a low-privileged account, without any action from a user. The record lists versions 9de3dc09e56f8deacd2bdbf4cecb71e11a312405, 7d61dbd7311ab978d8ddac1749a758de4de00374, 390d82733a953c1fabf3de9c9618091a7a9c90a6 as the first without the flaw, so updating Linux to one of those releases or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 0.28% chance of exploitation within 30 days, which is low compared with other CVEs.

Next patch cycle

High severity with no evidence of exploitation so far.

What to do

  1. Update Linux to 9de3dc09e56f8deacd2bdbf4cecb71e11a312405 or 7d61dbd7311ab978d8ddac1749a758de4de00374 or 390d82733a953c1fabf3de9c9618091a7a9c90a6 or 6f55fac0af3531cf60d11369454c41f5fc81ab3f, whichever matches your release line, or a later version.
  2. Update Linux Kernel to 4.5 or 4.9.318 or 4.14.283 or 4.19.247, whichever matches your release line, or a later version.

Affected products and versions

VendorProductAffected versionsFixed in
LinuxLinux22c66af08230a7030bdb88accffaec3424695631 up to, but not including, 9de3dc09e56f8deacd2bdbf4cecb71e11a312405; 0115a66ebb44bd9127ccb58cf43ed23c795eb1f0 up to, but not including, 7d61dbd7311ab978d8ddac1749a758de4de00374; bc4b08383046f3282b6fa58cfcef05bd13e52b93 up to, but not including, 390d82733a953c1fabf3de9c9618091a7a9c90a6; 5ccb04c6e1fb7b97fa2e1785b67c3a1cb3527ef7 up to, but not including, 6f55fac0af3531cf60d11369454c41f5fc81ab3f; 059c2c09f4b7f97711d0d8eaa0b9877f5e7d0a75 up to, but not including, 36c644c63bfcaee2d3a426f45e89a9cd09799318; e1dee2c1de2b4dd00eb44004a4bda6326ed07b59 up to, but not including, 65d347cb39e2e6bd0c2a745ad7c928998ebb0162; e1dee2c1de2b4dd00eb44004a4bda6326ed07b59 up to, but not including, 537f619dea4e3fa8ed1f8f938abffe3615794bcc; e1dee2c1de2b4dd00eb44004a4bda6326ed07b59 up to, but not including, 99df16007f4bbf9abfc3478cb17d10f0d7f8906e; and 13 more ranges9de3dc09e56f8deacd2bdbf4cecb71e11a312405, 7d61dbd7311ab978d8ddac1749a758de4de00374, 390d82733a953c1fabf3de9c9618091a7a9c90a6, 6f55fac0af3531cf60d11369454c41f5fc81ab3f, 36c644c63bfcaee2d3a426f45e89a9cd09799318, 65d347cb39e2e6bd0c2a745ad7c928998ebb0162
LinuxLinux Kernel4.4.284 up to, but not including, 4.5; 4.9.238 up to, but not including, 4.9.318; 4.14.247 up to, but not including, 4.14.283; 4.19.207 up to, but not including, 4.19.247; 5.4.146 up to, but not including, 5.4.198; 5.10.65 up to, but not including, 5.10.121; 5.13.17 up to, but not including, 5.14; 5.14.4 up to, but not including, 5.15.46; and 2 more ranges4.5, 4.9.318, 4.14.283, 4.19.247, 5.4.198, 5.10.121

Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.

How the severity score breaks down

Attack vector
LocalThe attacker needs local access or must trick a user into running something.
Attack complexity
LowNo special conditions are needed; the attack works reliably.
Privileges required
LowA basic user account is enough.
User interaction
NoneNo action by a victim is required.
Scope
UnchangedImpact stays within the vulnerable component.
Confidentiality
HighAll data handled by the component can be read.
Integrity
HighData or code can be modified at will.
Availability
HighThe component can be taken down completely.

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. Scored by CISA (ADP).

Official description

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: fix dangling sco_conn and use-after-free in sco_sock_timeout Connecting the same socket twice consecutively in sco_sock_connect() could lead to a race condition where two sco_conn objects are created but only one is associated with the socket. If the socket is closed before the SCO connection is established, the timer associated with the dangling sco_conn object won't be canceled. As the sock object is being freed, the use-after-free problem happens when the timer callback function sco_sock_timeout() accesses the socket. Here's the call trace: dump_stack+0x107/0x163 ? refcount_inc+0x1c/ print_address_description.constprop.0+0x1c/0x47e ? refcount_inc+0x1c/0x7b kasan_report+0x13a/0x173 ? refcount_inc+0x1c/0x7b check_memory_region+0x132/0x139 refcount_inc+0x1c/0x7b sco_sock_timeout+0xb2/0x1ba process_one_work+0x739/0xbd1 ? cancel_delayed_work+0x13f/0x13f ? __raw_spin_lock_init+0xf0/0xf0 ? to_kthread+0x59/0x85 worker_thread+0x593/0x70e kthread+0x346/0x35a ? drain_workqueue+0x31a/0x31a ? kthread_bind+0x4b/0x4b ret_from_fork+0x1f/0x30

Source: the CVE record as published by its numbering authority, via NVD and CVE.org.

The underlying weakness: Use After Free

The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory belongs to the code that operates on the new pointer.

How developers prevent this class of flaw

  • Choose a language that provides automatic memory management.
  • When freeing pointers, be sure to set them to NULL once they are freed. However, the utilization of multiple or complex data structures may lower the usefulness of this strategy.

More Use After Free vulnerabilities (CWE-416)

Timeline

  1. CVE record published.
  2. CISA published its SSVC assessment (exploitation: none, automatable: no, technical impact: total).
  3. Record last changed materially (score, affected products, status or references).

References

Recent Use After Free vulnerabilities

Spotted an error? Tell us.