CyberSecBulletin
CVE-2022-49530NVD status: Modified

Linux: Double Free

Published Updated By the CyberSecBulletin desk

CVE-2022-49530 is a high-severity double free vulnerability in Linux, with a CVSS 3.1 base score of 7.8 out of 10. It can be exploited with local access to the system by an attacker with a low-privileged account, without any action from a user. The record lists versions 2615464854505188f909d0c07c37a6623693b5c7, 6c5bdaa1325be7f04b79ea992ab216739192d342, c0e811c4ccf3b42705976285e3a94cc82dea7300 as the first without the flaw, so updating Linux to one of those releases or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 0.28% chance of exploitation within 30 days, which is low compared with other CVEs.

Next patch cycle

High severity with no evidence of exploitation so far.

What to do

  1. Update Linux to 2615464854505188f909d0c07c37a6623693b5c7 or 6c5bdaa1325be7f04b79ea992ab216739192d342 or c0e811c4ccf3b42705976285e3a94cc82dea7300 or af832028af6f44c6c45645757079c4ed6884ade5, whichever matches your release line, or a later version.
  2. Update Linux Kernel to 4.9.318 or 4.14.283 or 4.19.247 or 5.4.198, whichever matches your release line, or a later version.

Affected products and versions

VendorProductAffected versionsFixed in
LinuxLinux841686df9f7d2942cfd94d024b8591fa3f74ef7c up to, but not including, 2615464854505188f909d0c07c37a6623693b5c7; 841686df9f7d2942cfd94d024b8591fa3f74ef7c up to, but not including, 6c5bdaa1325be7f04b79ea992ab216739192d342; 841686df9f7d2942cfd94d024b8591fa3f74ef7c up to, but not including, c0e811c4ccf3b42705976285e3a94cc82dea7300; 841686df9f7d2942cfd94d024b8591fa3f74ef7c up to, but not including, af832028af6f44c6c45645757079c4ed6884ade5; 841686df9f7d2942cfd94d024b8591fa3f74ef7c up to, but not including, ca1ce206894dd976275c78ee38dbc19873f22de9; 841686df9f7d2942cfd94d024b8591fa3f74ef7c up to, but not including, a5ce7051db044290b1a95045ff03c249005a3aa4; 841686df9f7d2942cfd94d024b8591fa3f74ef7c up to, but not including, fd2eff8b9dcbe469c3b7bbbc7083ab5ed94de07b; 841686df9f7d2942cfd94d024b8591fa3f74ef7c up to, but not including, 43eb9b667b95f2a31c63e8949b0d2161b9be59c3; and 2 more ranges2615464854505188f909d0c07c37a6623693b5c7, 6c5bdaa1325be7f04b79ea992ab216739192d342, c0e811c4ccf3b42705976285e3a94cc82dea7300, af832028af6f44c6c45645757079c4ed6884ade5, ca1ce206894dd976275c78ee38dbc19873f22de9, a5ce7051db044290b1a95045ff03c249005a3aa4
LinuxLinux Kernelbefore 4.9.318; 4.10 up to, but not including, 4.14.283; 4.15 up to, but not including, 4.19.247; 4.20 up to, but not including, 5.4.198; 5.5 up to, but not including, 5.10.121; 5.11 up to, but not including, 5.15.46; 5.16 up to, but not including, 5.17.14; 5.18 up to, but not including, 5.18.34.9.318, 4.14.283, 4.19.247, 5.4.198, 5.10.121, 5.15.46

Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.

How the severity score breaks down

Attack vector
LocalThe attacker needs local access or must trick a user into running something.
Attack complexity
LowNo special conditions are needed; the attack works reliably.
Privileges required
LowA basic user account is enough.
User interaction
NoneNo action by a victim is required.
Scope
UnchangedImpact stays within the vulnerable component.
Confidentiality
HighAll data handled by the component can be read.
Integrity
HighData or code can be modified at will.
Availability
HighThe component can be taken down completely.

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. Scored by NVD.

Scoring systemScoreSeverityScored by
CVSS 3.17.8HighNVD
CVSS 3.17.8HighCISA (ADP)

Official description

In the Linux kernel, the following vulnerability has been resolved: drm/amd/pm: fix double free in si_parse_power_table() In function si_parse_power_table(), array adev->pm.dpm.ps and its member is allocated. If the allocation of each member fails, the array itself is freed and returned with an error code. However, the array is later freed again in si_dpm_fini() function which is called when the function returns an error. This leads to potential double free of the array adev->pm.dpm.ps, as well as leak of its array members, since the members are not freed in the allocation function and the array is not nulled when freed. In addition adev->pm.dpm.num_ps, which keeps track of the allocated array member, is not updated until the member allocation is successfully finished, this could also lead to either use after free, or uninitialized variable access in si_dpm_fini(). Fix this by postponing the free of the array until si_dpm_fini() and increment adev->pm.dpm.num_ps everytime the array member is allocated.

Source: the CVE record as published by its numbering authority, via NVD and CVE.org.

The underlying weakness: Double Free

The product calls free() twice on the same memory address.

How developers prevent this class of flaw

  • Choose a language that provides automatic memory management.
  • Ensure that each allocation is freed only once. After freeing a chunk, set the pointer to NULL to ensure the pointer cannot be freed again. In complicated error conditions, be sure that clean-up routines respect the state of allocation properly. If the language is object oriented, ensure that object destructors delete each chunk of memory only once.
  • Use a static analysis tool to find double free instances.

More Double Free vulnerabilities (CWE-415)

Timeline

  1. CVE record published.
  2. CISA published its SSVC assessment (exploitation: none, automatable: no, technical impact: total).
  3. Record last changed materially (score, affected products, status or references).

References

Recent Double Free vulnerabilities

Spotted an error? Tell us.