Linux: Double Free
CVE-2022-49775 is a high-severity double free vulnerability in Linux, with a CVSS 3.1 base score of 7.8 out of 10. It can be exploited with local access to the system by an attacker with a low-privileged account, without any action from a user. The record lists versions 0b19171439016a8e4c97eafe543670ac86e2b8fe, 4026033907cc6186d86b48daa4a252c860db2536, 9e481d87349d2282f400ee1d010a169c99f766b8 as the first without the flaw, so updating Linux to one of those releases or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 0.21% chance of exploitation within 30 days, which is low compared with other CVEs.
High severity with no evidence of exploitation so far.
What to do
- Update Linux to 0b19171439016a8e4c97eafe543670ac86e2b8fe or 4026033907cc6186d86b48daa4a252c860db2536 or 9e481d87349d2282f400ee1d010a169c99f766b8 or 78be2ee0112409ae4e9ee9e326151e0559b3d239, whichever matches your release line, or a later version.
- Update Linux Kernel to 4.9.334 or 4.14.300 or 4.19.267 or 5.4.225, whichever matches your release line, or a later version.
Affected products and versions
| Vendor | Product | Affected versions | Fixed in |
|---|---|---|---|
| Linux | Linux | 2b0a8c9eee81882fc0001ccf6d9af62cdc682f9e up to, but not including, 0b19171439016a8e4c97eafe543670ac86e2b8fe; 2b0a8c9eee81882fc0001ccf6d9af62cdc682f9e up to, but not including, 4026033907cc6186d86b48daa4a252c860db2536; 2b0a8c9eee81882fc0001ccf6d9af62cdc682f9e up to, but not including, 9e481d87349d2282f400ee1d010a169c99f766b8; 2b0a8c9eee81882fc0001ccf6d9af62cdc682f9e up to, but not including, 78be2ee0112409ae4e9ee9e326151e0559b3d239; 2b0a8c9eee81882fc0001ccf6d9af62cdc682f9e up to, but not including, 35309be06b6feded2ab2cafbc2bca8534c2fa41e; 2b0a8c9eee81882fc0001ccf6d9af62cdc682f9e up to, but not including, b49026d9c86f35a4c5bfb8d7345c9c4379828c6b; 2b0a8c9eee81882fc0001ccf6d9af62cdc682f9e up to, but not including, 1b639be27cbf428a5ca01dcf8b5d654194c956f8; 2b0a8c9eee81882fc0001ccf6d9af62cdc682f9e up to, but not including, 72e560cb8c6f80fc2b4afc5d3634a32465e13a51; and 1 more ranges | 0b19171439016a8e4c97eafe543670ac86e2b8fe, 4026033907cc6186d86b48daa4a252c860db2536, 9e481d87349d2282f400ee1d010a169c99f766b8, 78be2ee0112409ae4e9ee9e326151e0559b3d239, 35309be06b6feded2ab2cafbc2bca8534c2fa41e, b49026d9c86f35a4c5bfb8d7345c9c4379828c6b |
| Linux | Linux Kernel | 4.2 up to, but not including, 4.9.334; 4.10 up to, but not including, 4.14.300; 4.15 up to, but not including, 4.19.267; 4.20 up to, but not including, 5.4.225; 5.5 up to, but not including, 5.10.156; 5.11 up to, but not including, 5.15.80; 5.16 up to, but not including, 6.0.10 | 4.9.334, 4.14.300, 4.19.267, 5.4.225, 5.10.156, 5.15.80 |
Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.
How the severity score breaks down
- Attack vector
- LocalThe attacker needs local access or must trick a user into running something.
- Attack complexity
- LowNo special conditions are needed; the attack works reliably.
- Privileges required
- LowA basic user account is enough.
- User interaction
- NoneNo action by a victim is required.
- Scope
- UnchangedImpact stays within the vulnerable component.
- Confidentiality
- HighAll data handled by the component can be read.
- Integrity
- HighData or code can be modified at will.
- Availability
- HighThe component can be taken down completely.
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. Scored by NVD.
| Scoring system | Score | Severity | Scored by |
|---|---|---|---|
| CVSS 3.1 | 7.8 | High | CNA |
| CVSS 3.1 | 7.8 | High | NVD |
Official description
In the Linux kernel, the following vulnerability has been resolved: tcp: cdg: allow tcp_cdg_release() to be called multiple times Apparently, mptcp is able to call tcp_disconnect() on an already disconnected flow. This is generally fine, unless current congestion control is CDG, because it might trigger a double-free [1] Instead of fixing MPTCP, and future bugs, we can make tcp_disconnect() more resilient. [1] BUG: KASAN: double-free in slab_free mm/slub.c:3539 [inline] BUG: KASAN: double-free in kfree+0xe2/0x580 mm/slub.c:4567 CPU: 0 PID: 3645 Comm: kworker/0:7 Not tainted 6.0.0-syzkaller-02734-g0326074ff465 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/22/2022 Workqueue: events mptcp_worker Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106 print_address_description mm/kasan/report.c:317 [inline] print_report.cold+0x2ba/0x719 mm/kasan/report.c:433 kasan_report_invalid_free+0x81/0x190 mm/kasan/report.c:462 ____kasan_slab_free+0x18b/0x1c0 mm/kasan/common.c:356 kasan_slab_free include/linux/kasan.h:200 [inline] slab_free_hook mm/slub.c:1759 [inline] slab_free_freelist_hook+0x8b/0x1c0 mm/slub.c:1785 slab_free mm/slub.c:3539 [inline] kfree+0xe2/0x580 mm/slub.c:4567 tcp_disconnect+0x980/0x1e20 net/ipv4/tcp.c:3145 __mptcp_close_ssk+0x5ca/0x7e0 net/mptcp/protocol.c:2327 mptcp_do_fastclose net/mptcp/protocol.c:2592 [inline] mptcp_worker+0x78c/0xff0 net/mptcp/protocol.c:2627 process_one_work+0x991/0x1610 kernel/workqueue.c:2289 worker_thread+0x665/0x1080 kernel/workqueue.c:2436 kthread+0x2e4/0x3a0 kernel/kthread.c:376 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:306 </TASK> Allocated by task 3671: kasan_save_stack+0x1e/0x40 mm/kasan/common.c:38 kasan_set_track mm/kasan/common.c:45 [inline] set_alloc_info mm/kasan/common.c:437 [inline] ____kasan_kmalloc mm/kasan/common.c:516 [inline] ____kasan_kmalloc mm/kasan/common.c:475 [inline] __kasan_kmalloc+0xa9/0xd0 mm/kasan/common.c:525 kmalloc_array include/linux/slab.h:640 [inline] kcalloc include/linux/slab.h:671 [inline] tcp_cdg_init+0x10d/0x170 net/ipv4/tcp_cdg.c:380 tcp_init_congestion_control+0xab/0x550 net/ipv4/tcp_cong.c:193 tcp_reinit_congestion_control net/ipv4/tcp_cong.c:217 [inline] tcp_set_congestion_control+0x96c/0xaa0 net/ipv4/tcp_cong.c:391 do_tcp_setsockopt+0x505/0x2320 net/ipv4/tcp.c:3513 tcp_setsockopt+0xd4/0x100 net/ipv4/tcp.c:3801 mptcp_setsockopt+0x35f/0x2570 net/mptcp/sockopt.c:844 __sys_setsockopt+0x2d6/0x690 net/socket.c:2252 __do_sys_setsockopt net/socket.c:2263 [inline] __se_sys_setsockopt net/socket.c:2260 [inline] __x64_sys_setsockopt+0xba/0x150 net/socket.c:2260 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd Freed by task 16: kasan_save_stack+0x1e/0x40 mm/kasan/common.c:38 kasan_set_track+0x21/0x30 mm/kasan/common.c:45 kasan_set_free_info+0x20/0x30 mm/kasan/generic.c:370 ____kasan_slab_free mm/kasan/common.c:367 [inline] ____kasan_slab_free+0x166/0x1c0 mm/kasan/common.c:329 kasan_slab_free include/linux/kasan.h:200 [inline] slab_free_hook mm/slub.c:1759 [inline] slab_free_freelist_hook+0x8b/0x1c0 mm/slub.c:1785 slab_free mm/slub.c:3539 [inline] kfree+0xe2/0x580 mm/slub.c:4567 tcp_cleanup_congestion_control+0x70/0x120 net/ipv4/tcp_cong.c:226 tcp_v4_destroy_sock+0xdd/0x750 net/ipv4/tcp_ipv4.c:2254 tcp_v6_destroy_sock+0x11/0x20 net/ipv6/tcp_ipv6.c:1969 inet_csk_destroy_sock+0x196/0x440 net/ipv4/inet_connection_sock.c:1157 tcp_done+0x23b/0x340 net/ipv4/tcp.c:4649 tcp_rcv_state_process+0x40e7/0x4990 net/ipv4/tcp_input.c:6624 tcp_v6_do_rcv+0x3fc/0x13c0 net/ipv6/tcp_ipv6.c:1525 tcp_v6_rcv+0x2e8e/0x3830 net/ipv6/tcp_ipv6.c:1759 ip6_protocol_deliver_rcu+0x2db/0x1950 net/ipv6/ip6_input.c:439 ip6_input_finish+0x14c/0x2c0 net/ipv6/ip6_input.c:484 NF_HOOK include/linux/netfilter.h:302 [inline] NF_HOOK include/linux/netfilter.h:296 [inline] ip6_input+0x9c/0xd ---truncated---
Source: the CVE record as published by its numbering authority, via NVD and CVE.org.
The underlying weakness: Double Free
The product calls free() twice on the same memory address.
How developers prevent this class of flaw
- Choose a language that provides automatic memory management.
- Ensure that each allocation is freed only once. After freeing a chunk, set the pointer to NULL to ensure the pointer cannot be freed again. In complicated error conditions, be sure that clean-up routines respect the state of allocation properly. If the language is object oriented, ensure that object destructors delete each chunk of memory only once.
- Use a static analysis tool to find double free instances.
Timeline
- CVE record published.
- Record last changed materially (score, affected products, status or references).
References
Patches and release notes
- git.kernel.org/stable/c/0b19171439016a8e4c97eafe543670ac86e2b8fe
- git.kernel.org/stable/c/1b639be27cbf428a5ca01dcf8b5d654194c956f8
- git.kernel.org/stable/c/35309be06b6feded2ab2cafbc2bca8534c2fa41e
- git.kernel.org/stable/c/4026033907cc6186d86b48daa4a252c860db2536
- git.kernel.org/stable/c/72e560cb8c6f80fc2b4afc5d3634a32465e13a51
- git.kernel.org/stable/c/78be2ee0112409ae4e9ee9e326151e0559b3d239
- git.kernel.org/stable/c/9e481d87349d2282f400ee1d010a169c99f766b8
- git.kernel.org/stable/c/b49026d9c86f35a4c5bfb8d7345c9c4379828c6b
Recent Double Free vulnerabilities
- 7.8 High severity
- 7.8 High severity
- 7.8 High severity
- 7.8 High severity
- 7.8 High severity
- 7.8 High severity
Spotted an error? Tell us.