Linux: Use After Free
CVE-2022-49501 is a high-severity use after free vulnerability in Linux, with a CVSS 3.1 base score of 7.8 out of 10. It can be exploited with local access to the system by an attacker with a low-privileged account, without any action from a user. The record lists versions 6d5deb242874d924beccf7eb3cef04c1c3b0da79, fbda837107f9bd4ec658d2aa88c6856dba606f06, 969a1b3ea3cb7d58a16fe12fd1b04bfc0ea40509 as the first without the flaw, so updating Linux to one of those releases or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 0.27% chance of exploitation within 30 days, which is low compared with other CVEs.
High severity with no evidence of exploitation so far.
What to do
- Update Linux to 6d5deb242874d924beccf7eb3cef04c1c3b0da79 or fbda837107f9bd4ec658d2aa88c6856dba606f06 or 969a1b3ea3cb7d58a16fe12fd1b04bfc0ea40509 or d1408f6b4dd78fb1b9e26bcf64477984e5f85409, whichever matches your release line, or a later version.
- Update Linux Kernel to 5.15.46 or 5.17.14 or 5.18.3, whichever matches your release line, or a later version.
Affected products and versions
| Vendor | Product | Affected versions | Fixed in |
|---|---|---|---|
| Linux | Linux | 2c9d6c2b871d5841ce26ede3e81fd37e2e33c42c up to, but not including, 6d5deb242874d924beccf7eb3cef04c1c3b0da79; 2c9d6c2b871d5841ce26ede3e81fd37e2e33c42c up to, but not including, fbda837107f9bd4ec658d2aa88c6856dba606f06; 2c9d6c2b871d5841ce26ede3e81fd37e2e33c42c up to, but not including, 969a1b3ea3cb7d58a16fe12fd1b04bfc0ea40509; 2c9d6c2b871d5841ce26ede3e81fd37e2e33c42c up to, but not including, d1408f6b4dd78fb1b9e26bcf64477984e5f85409; 5.14 | 6d5deb242874d924beccf7eb3cef04c1c3b0da79, fbda837107f9bd4ec658d2aa88c6856dba606f06, 969a1b3ea3cb7d58a16fe12fd1b04bfc0ea40509, d1408f6b4dd78fb1b9e26bcf64477984e5f85409 |
| Linux | Linux Kernel | before 5.15.46; 5.16 up to, but not including, 5.17.14; 5.18 up to, but not including, 5.18.3 | 5.15.46, 5.17.14, 5.18.3 |
Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.
How the severity score breaks down
- Attack vector
- LocalThe attacker needs local access or must trick a user into running something.
- Attack complexity
- LowNo special conditions are needed; the attack works reliably.
- Privileges required
- LowA basic user account is enough.
- User interaction
- NoneNo action by a victim is required.
- Scope
- UnchangedImpact stays within the vulnerable component.
- Confidentiality
- HighAll data handled by the component can be read.
- Integrity
- HighData or code can be modified at will.
- Availability
- HighThe component can be taken down completely.
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. Scored by CISA (ADP).
Official description
In the Linux kernel, the following vulnerability has been resolved: usbnet: Run unregister_netdev() before unbind() again Commit 2c9d6c2b871d ("usbnet: run unbind() before unregister_netdev()") sought to fix a use-after-free on disconnect of USB Ethernet adapters. It turns out that a different fix is necessary to address the issue: https://lore.kernel.org/netdev/18b3541e5372bc9b9fc733d422f4e698c089077c.1650177997.git.lukas@wunner.de/ So the commit was not necessary. The commit made binding and unbinding of USB Ethernet asymmetrical: Before, usbnet_probe() first invoked the ->bind() callback and then register_netdev(). usbnet_disconnect() mirrored that by first invoking unregister_netdev() and then ->unbind(). Since the commit, the order in usbnet_disconnect() is reversed and no longer mirrors usbnet_probe(). One consequence is that a PHY disconnected (and stopped) in ->unbind() is afterwards stopped once more by unregister_netdev() as it closes the netdev before unregistering. That necessitates a contortion in ->stop() because the PHY may only be stopped if it hasn't already been disconnected. Reverting the commit allows making the call to phy_stop() unconditional in ->stop().
Source: the CVE record as published by its numbering authority, via NVD and CVE.org.
The underlying weakness: Use After Free
The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory belongs to the code that operates on the new pointer.
How developers prevent this class of flaw
- Choose a language that provides automatic memory management.
- When freeing pointers, be sure to set them to NULL once they are freed. However, the utilization of multiple or complex data structures may lower the usefulness of this strategy.
Timeline
- CVE record published.
- CISA published its SSVC assessment (exploitation: none, automatable: no, technical impact: total).
- Record last changed materially (score, affected products, status or references).
References
Patches and release notes
Recent Use After Free vulnerabilities
- 7.8 High severity
- 7.8 High severity
- 7.8 High severity
- 7.8 High severity
- 7.8 High severity
- 7.8 High severity
Spotted an error? Tell us.