Linux: Double Free
CVE-2022-49519 is a high-severity double free vulnerability in Linux, with a CVSS 3.1 base score of 7.8 out of 10. It can be exploited with local access to the system by an attacker with a low-privileged account, without any action from a user. The record lists versions 8aa3750986ffcf73e0692db3b40dd3a8e8c0c575, c2272428090d0d215a3f017cbbbad731c07eee53, 7eb14cb604f49e58b7cf6faa87961a865a3c8649 as the first without the flaw, so updating Linux to one of those releases or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 0.35% chance of exploitation within 30 days, which is low compared with other CVEs.
High severity with no evidence of exploitation so far.
What to do
- Update Linux to 8aa3750986ffcf73e0692db3b40dd3a8e8c0c575 or c2272428090d0d215a3f017cbbbad731c07eee53 or 7eb14cb604f49e58b7cf6faa87961a865a3c8649 or 5321e5211b5dc873e2e3d0deb749e69ecf4dbfe5, whichever matches your release line, or a later version.
- Update Linux Kernel to 5.10.121 or 5.15.46 or 5.17.14 or 5.18.3, whichever matches your release line, or a later version.
Affected products and versions
| Vendor | Product | Affected versions | Fixed in |
|---|---|---|---|
| Linux | Linux | c2cac2f74ab4bcf0db0dcf3a612f1e5b52d145c8 up to, but not including, 8aa3750986ffcf73e0692db3b40dd3a8e8c0c575; c2cac2f74ab4bcf0db0dcf3a612f1e5b52d145c8 up to, but not including, c2272428090d0d215a3f017cbbbad731c07eee53; c2cac2f74ab4bcf0db0dcf3a612f1e5b52d145c8 up to, but not including, 7eb14cb604f49e58b7cf6faa87961a865a3c8649; c2cac2f74ab4bcf0db0dcf3a612f1e5b52d145c8 up to, but not including, 5321e5211b5dc873e2e3d0deb749e69ecf4dbfe5; c2cac2f74ab4bcf0db0dcf3a612f1e5b52d145c8 up to, but not including, b72a4aff947ba807177bdabb43debaf2c66bee05; ea23fca0c60045afbbeceef1926893d905eb1b36; 4.9.2 up to, but not including, 4.10; 4.10 | 8aa3750986ffcf73e0692db3b40dd3a8e8c0c575, c2272428090d0d215a3f017cbbbad731c07eee53, 7eb14cb604f49e58b7cf6faa87961a865a3c8649, 5321e5211b5dc873e2e3d0deb749e69ecf4dbfe5, b72a4aff947ba807177bdabb43debaf2c66bee05, 4.10 |
| Linux | Linux Kernel | 3.11 up to, but not including, 5.10.121; 5.11 up to, but not including, 5.15.46; 5.16 up to, but not including, 5.17.14; 5.18 up to, but not including, 5.18.3 | 5.10.121, 5.15.46, 5.17.14, 5.18.3 |
Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.
How the severity score breaks down
- Attack vector
- LocalThe attacker needs local access or must trick a user into running something.
- Attack complexity
- LowNo special conditions are needed; the attack works reliably.
- Privileges required
- LowA basic user account is enough.
- User interaction
- NoneNo action by a victim is required.
- Scope
- UnchangedImpact stays within the vulnerable component.
- Confidentiality
- HighAll data handled by the component can be read.
- Integrity
- HighData or code can be modified at will.
- Availability
- HighThe component can be taken down completely.
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. Scored by NVD.
| Scoring system | Score | Severity | Scored by |
|---|---|---|---|
| CVSS 3.1 | 8.8 | High | CNA |
| CVSS 3.1 | 7.8 | High | NVD |
Official description
In the Linux kernel, the following vulnerability has been resolved: ath10k: skip ath10k_halt during suspend for driver state RESTARTING Double free crash is observed when FW recovery(caused by wmi timeout/crash) is followed by immediate suspend event. The FW recovery is triggered by ath10k_core_restart() which calls driver clean up via ath10k_halt(). When the suspend event occurs between the FW recovery, the restart worker thread is put into frozen state until suspend completes. The suspend event triggers ath10k_stop() which again triggers ath10k_halt() The double invocation of ath10k_halt() causes ath10k_htt_rx_free() to be called twice(Note: ath10k_htt_rx_alloc was not called by restart worker thread because of its frozen state), causing the crash. To fix this, during the suspend flow, skip call to ath10k_halt() in ath10k_stop() when the current driver state is ATH10K_STATE_RESTARTING. Also, for driver state ATH10K_STATE_RESTARTING, call ath10k_wait_for_suspend() in ath10k_stop(). This is because call to ath10k_wait_for_suspend() is skipped later in [ath10k_halt() > ath10k_core_stop()] for the driver state ATH10K_STATE_RESTARTING. The frozen restart worker thread will be cancelled during resume when the device comes out of suspend. Below is the crash stack for reference: [ 428.469167] ------------[ cut here ]------------ [ 428.469180] kernel BUG at mm/slub.c:4150! [ 428.469193] invalid opcode: 0000 [#1] PREEMPT SMP NOPTI [ 428.469219] Workqueue: events_unbound async_run_entry_fn [ 428.469230] RIP: 0010:kfree+0x319/0x31b [ 428.469241] RSP: 0018:ffffa1fac015fc30 EFLAGS: 00010246 [ 428.469247] RAX: ffffedb10419d108 RBX: ffff8c05262b0000 [ 428.469252] RDX: ffff8c04a8c07000 RSI: 0000000000000000 [ 428.469256] RBP: ffffa1fac015fc78 R08: 0000000000000000 [ 428.469276] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 428.469285] Call Trace: [ 428.469295] ? dma_free_attrs+0x5f/0x7d [ 428.469320] ath10k_core_stop+0x5b/0x6f [ 428.469336] ath10k_halt+0x126/0x177 [ 428.469352] ath10k_stop+0x41/0x7e [ 428.469387] drv_stop+0x88/0x10e [ 428.469410] __ieee80211_suspend+0x297/0x411 [ 428.469441] rdev_suspend+0x6e/0xd0 [ 428.469462] wiphy_suspend+0xb1/0x105 [ 428.469483] ? name_show+0x2d/0x2d [ 428.469490] dpm_run_callback+0x8c/0x126 [ 428.469511] ? name_show+0x2d/0x2d [ 428.469517] __device_suspend+0x2e7/0x41b [ 428.469523] async_suspend+0x1f/0x93 [ 428.469529] async_run_entry_fn+0x3d/0xd1 [ 428.469535] process_one_work+0x1b1/0x329 [ 428.469541] worker_thread+0x213/0x372 [ 428.469547] kthread+0x150/0x15f [ 428.469552] ? pr_cont_work+0x58/0x58 [ 428.469558] ? kthread_blkcg+0x31/0x31 Tested-on: QCA6174 hw3.2 PCI WLAN.RM.4.4.1-00288-QCARMSWPZ-1
Source: the CVE record as published by its numbering authority, via NVD and CVE.org.
The underlying weakness: Double Free
The product calls free() twice on the same memory address.
How developers prevent this class of flaw
- Choose a language that provides automatic memory management.
- Ensure that each allocation is freed only once. After freeing a chunk, set the pointer to NULL to ensure the pointer cannot be freed again. In complicated error conditions, be sure that clean-up routines respect the state of allocation properly. If the language is object oriented, ensure that object destructors delete each chunk of memory only once.
- Use a static analysis tool to find double free instances.
Timeline
- CVE record published.
- Record last changed materially (score, affected products, status or references).
References
Patches and release notes
- git.kernel.org/stable/c/5321e5211b5dc873e2e3d0deb749e69ecf4dbfe5
- git.kernel.org/stable/c/7eb14cb604f49e58b7cf6faa87961a865a3c8649
- git.kernel.org/stable/c/8aa3750986ffcf73e0692db3b40dd3a8e8c0c575
- git.kernel.org/stable/c/b72a4aff947ba807177bdabb43debaf2c66bee05
- git.kernel.org/stable/c/c2272428090d0d215a3f017cbbbad731c07eee53
Recent Double Free vulnerabilities
- 7.8 High severity
- 7.8 High severity
- 7.8 High severity
- 7.8 High severity
- 7.8 High severity
- 7.8 High severity
Spotted an error? Tell us.