CyberSecBulletin
CVE-2022-49939NVD status: Modified

Linux: Concurrent Execution using Shared Resource with Improper Synchronization

Published Updated By the CyberSecBulletin desk

CVE-2022-49939 is a high-severity concurrent execution using shared resource with improper synchronization vulnerability in Linux, with a CVSS 3.1 base score of 7.0 out of 10. It can be exploited with local access to the system by an attacker with a low-privileged account, without any action from a user. The record lists versions 229f47603dd306bc0eb1a831439adb8e48bb0eae, 06e5b43ca4dab06a92bf4c2f33766e6fb11b880a, 30d0901b307f27d36b2655fb3048cf31ee0e89c0 as the first without the flaw, so updating Linux to one of those releases or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 0.18% chance of exploitation within 30 days, which is low compared with other CVEs.

Next patch cycle

High severity with no evidence of exploitation so far.

What to do

  1. Update Linux to 229f47603dd306bc0eb1a831439adb8e48bb0eae or 06e5b43ca4dab06a92bf4c2f33766e6fb11b880a or 30d0901b307f27d36b2655fb3048cf31ee0e89c0 or 9629f2dfdb1dad294b468038ff8e161e94d0b609, whichever matches your release line, or a later version.
  2. Update Linux Kernel to 4.14.293 or 4.19.258 or 5.4.213 or 5.10.142, whichever matches your release line, or a later version.

Affected products and versions

VendorProductAffected versionsFixed in
LinuxLinux372e3147df7016ebeaa372939e8774a1292db558 up to, but not including, 229f47603dd306bc0eb1a831439adb8e48bb0eae; 372e3147df7016ebeaa372939e8774a1292db558 up to, but not including, 06e5b43ca4dab06a92bf4c2f33766e6fb11b880a; 372e3147df7016ebeaa372939e8774a1292db558 up to, but not including, 30d0901b307f27d36b2655fb3048cf31ee0e89c0; 372e3147df7016ebeaa372939e8774a1292db558 up to, but not including, 9629f2dfdb1dad294b468038ff8e161e94d0b609; 372e3147df7016ebeaa372939e8774a1292db558 up to, but not including, c2a4b5dc8fa71af73bab704d0cac42ac39767ed6; 372e3147df7016ebeaa372939e8774a1292db558 up to, but not including, 603a47f2ae56bf68288784d3c0a8c5b8e0a827ed; 372e3147df7016ebeaa372939e8774a1292db558 up to, but not including, a0e44c64b6061dda7e00b7c458e4523e2331b739; 4.14229f47603dd306bc0eb1a831439adb8e48bb0eae, 06e5b43ca4dab06a92bf4c2f33766e6fb11b880a, 30d0901b307f27d36b2655fb3048cf31ee0e89c0, 9629f2dfdb1dad294b468038ff8e161e94d0b609, c2a4b5dc8fa71af73bab704d0cac42ac39767ed6, 603a47f2ae56bf68288784d3c0a8c5b8e0a827ed
LinuxLinux Kernelbefore 4.14.293; 4.15 up to, but not including, 4.19.258; 4.20 up to, but not including, 5.4.213; 5.5 up to, but not including, 5.10.142; 5.11 up to, but not including, 5.15.66; 5.16 up to, but not including, 5.19.8; 6.04.14.293, 4.19.258, 5.4.213, 5.10.142, 5.15.66, 5.19.8

Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.

How the severity score breaks down

Attack vector
LocalThe attacker needs local access or must trick a user into running something.
Attack complexity
HighSuccess depends on conditions outside the attacker's control.
Privileges required
LowA basic user account is enough.
User interaction
NoneNo action by a victim is required.
Scope
UnchangedImpact stays within the vulnerable component.
Confidentiality
HighAll data handled by the component can be read.
Integrity
HighData or code can be modified at will.
Availability
HighThe component can be taken down completely.

Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H. Scored by NVD.

Scoring systemScoreSeverityScored by
CVSS 3.17.8HighCNA
CVSS 3.17.0HighNVD

Official description

In the Linux kernel, the following vulnerability has been resolved: binder: fix UAF of ref->proc caused by race condition A transaction of type BINDER_TYPE_WEAK_HANDLE can fail to increment the reference for a node. In this case, the target proc normally releases the failed reference upon close as expected. However, if the target is dying in parallel the call will race with binder_deferred_release(), so the target could have released all of its references by now leaving the cleanup of the new failed reference unhandled. The transaction then ends and the target proc gets released making the ref->proc now a dangling pointer. Later on, ref->node is closed and we attempt to take spin_lock(&ref->proc->inner_lock), which leads to the use-after-free bug reported below. Let's fix this by cleaning up the failed reference on the spot instead of relying on the target to do so. ================================================================== BUG: KASAN: use-after-free in _raw_spin_lock+0xa8/0x150 Write of size 4 at addr ffff5ca207094238 by task kworker/1:0/590 CPU: 1 PID: 590 Comm: kworker/1:0 Not tainted 5.19.0-rc8 #10 Hardware name: linux,dummy-virt (DT) Workqueue: events binder_deferred_func Call trace: dump_backtrace.part.0+0x1d0/0x1e0 show_stack+0x18/0x70 dump_stack_lvl+0x68/0x84 print_report+0x2e4/0x61c kasan_report+0xa4/0x110 kasan_check_range+0xfc/0x1a4 __kasan_check_write+0x3c/0x50 _raw_spin_lock+0xa8/0x150 binder_deferred_func+0x5e0/0x9b0 process_one_work+0x38c/0x5f0 worker_thread+0x9c/0x694 kthread+0x188/0x190 ret_from_fork+0x10/0x20

Source: the CVE record as published by its numbering authority, via NVD and CVE.org.

The underlying weakness: Concurrent Execution using Shared Resource with Improper Synchronization

The product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently.

How developers prevent this class of flaw

  • In languages that support it, use synchronization primitives. Only wrap these around critical code to minimize the impact on performance.
  • Use thread-safe capabilities such as the data access abstraction in Spring.
  • Minimize the usage of shared resources in order to remove as much complexity as possible from the control flow and to reduce the likelihood of unexpected conditions occurring. Additionally, this will minimize the amount of synchronization necessary and may even help to reduce the likelihood of a denial of service where an attacker may be able to repeatedly trigger a critical section (CWE-400).

More Concurrent Execution using Shared Resource with Improper Synchronization vulnerabilities (CWE-362)

Timeline

  1. CVE record published.
  2. Record last changed materially (score, affected products, status or references).

References

Recent Concurrent Execution using Shared Resource with Improper Synchronization vulnerabilities

Spotted an error? Tell us.