Linux: Use After Free
CVE-2022-50067 is a high-severity use after free vulnerability in Linux, with a CVSS 3.1 base score of 7.8 out of 10. It can be exploited with local access to the system by an attacker with a low-privileged account, without any action from a user. The record lists versions ff0e8ed8dfb584575cffc1561f17a1d094e8565b, dcb11fe0a0a9cca2b7425191b9bf30dc29f2ad0f, 8e546674031fc1576da501e27a8fd165222e5a37 as the first without the flaw, so updating Linux to one of those releases or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 0.24% chance of exploitation within 30 days, which is low compared with other CVEs.
High severity with no evidence of exploitation so far.
What to do
- Update Linux to ff0e8ed8dfb584575cffc1561f17a1d094e8565b or dcb11fe0a0a9cca2b7425191b9bf30dc29f2ad0f or 8e546674031fc1576da501e27a8fd165222e5a37 or b60e862e133f646f19023ece1d476d630a660de1, whichever matches your release line, or a later version.
- Update Linux Kernel to 4.14.318 or 4.19.286 or 5.4.247 or 5.10.184, whichever matches your release line, or a later version.
Affected products and versions
| Vendor | Product | Affected versions | Fixed in |
|---|---|---|---|
| Linux | Linux | 1a5353475df8fcaf200fecc9e961a3900d15e891 up to, but not including, ff0e8ed8dfb584575cffc1561f17a1d094e8565b; 499d29bf151951399367ba83645abfdb429a3af9 up to, but not including, dcb11fe0a0a9cca2b7425191b9bf30dc29f2ad0f; 4223d91ca1b5bf3928e5722c3c6b3fdb49250ab3 up to, but not including, 8e546674031fc1576da501e27a8fd165222e5a37; 6f371623f315c26100e603c2e8837cdbe130f9e0 up to, but not including, b60e862e133f646f19023ece1d476d630a660de1; fb686c6824dd6294ca772b92424b8fba666e7d00 up to, but not including, 78f8c2370e3d33e35f23bdc648653d779aeacb6e; fb686c6824dd6294ca772b92424b8fba666e7d00 up to, but not including, 5d741afed0bac206640cc64d77b97853283cf719; fb686c6824dd6294ca772b92424b8fba666e7d00 up to, but not including, 85f02d6c856b9f3a0acf5219de6e32f58b9778eb; 5.13 | ff0e8ed8dfb584575cffc1561f17a1d094e8565b, dcb11fe0a0a9cca2b7425191b9bf30dc29f2ad0f, 8e546674031fc1576da501e27a8fd165222e5a37, b60e862e133f646f19023ece1d476d630a660de1, 78f8c2370e3d33e35f23bdc648653d779aeacb6e, 5d741afed0bac206640cc64d77b97853283cf719 |
| Linux | Linux Kernel | before 4.14.318; 4.15 up to, but not including, 4.19.286; 4.20 up to, but not including, 5.4.247; 5.5 up to, but not including, 5.10.184; 5.11 up to, but not including, 5.15.63; 5.16 up to, but not including, 5.19.4; 6.0 | 4.14.318, 4.19.286, 5.4.247, 5.10.184, 5.15.63, 5.19.4 |
Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.
How the severity score breaks down
- Attack vector
- LocalThe attacker needs local access or must trick a user into running something.
- Attack complexity
- LowNo special conditions are needed; the attack works reliably.
- Privileges required
- LowA basic user account is enough.
- User interaction
- NoneNo action by a victim is required.
- Scope
- UnchangedImpact stays within the vulnerable component.
- Confidentiality
- HighAll data handled by the component can be read.
- Integrity
- HighData or code can be modified at will.
- Availability
- HighThe component can be taken down completely.
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. Scored by NVD.
Official description
In the Linux kernel, the following vulnerability has been resolved: btrfs: unset reloc control if transaction commit fails in prepare_to_relocate() In btrfs_relocate_block_group(), the rc is allocated. Then btrfs_relocate_block_group() calls relocate_block_group() prepare_to_relocate() set_reloc_control() that assigns rc to the variable fs_info->reloc_ctl. When prepare_to_relocate() returns, it calls btrfs_commit_transaction() btrfs_start_dirty_block_groups() btrfs_alloc_path() kmem_cache_zalloc() which may fail for example (or other errors could happen). When the failure occurs, btrfs_relocate_block_group() detects the error and frees rc and doesn't set fs_info->reloc_ctl to NULL. After that, in btrfs_init_reloc_root(), rc is retrieved from fs_info->reloc_ctl and then used, which may cause a use-after-free bug. This possible bug can be triggered by calling btrfs_ioctl_balance() before calling btrfs_ioctl_defrag(). To fix this possible bug, in prepare_to_relocate(), check if btrfs_commit_transaction() fails. If the failure occurs, unset_reloc_control() is called to set fs_info->reloc_ctl to NULL. The error log in our fault-injection testing is shown as follows: [ 58.751070] BUG: KASAN: use-after-free in btrfs_init_reloc_root+0x7ca/0x920 [btrfs] ... [ 58.753577] Call Trace: ... [ 58.755800] kasan_report+0x45/0x60 [ 58.756066] btrfs_init_reloc_root+0x7ca/0x920 [btrfs] [ 58.757304] record_root_in_trans+0x792/0xa10 [btrfs] [ 58.757748] btrfs_record_root_in_trans+0x463/0x4f0 [btrfs] [ 58.758231] start_transaction+0x896/0x2950 [btrfs] [ 58.758661] btrfs_defrag_root+0x250/0xc00 [btrfs] [ 58.759083] btrfs_ioctl_defrag+0x467/0xa00 [btrfs] [ 58.759513] btrfs_ioctl+0x3c95/0x114e0 [btrfs] ... [ 58.768510] Allocated by task 23683: [ 58.768777] ____kasan_kmalloc+0xb5/0xf0 [ 58.769069] __kmalloc+0x227/0x3d0 [ 58.769325] alloc_reloc_control+0x10a/0x3d0 [btrfs] [ 58.769755] btrfs_relocate_block_group+0x7aa/0x1e20 [btrfs] [ 58.770228] btrfs_relocate_chunk+0xf1/0x760 [btrfs] [ 58.770655] __btrfs_balance+0x1326/0x1f10 [btrfs] [ 58.771071] btrfs_balance+0x3150/0x3d30 [btrfs] [ 58.771472] btrfs_ioctl_balance+0xd84/0x1410 [btrfs] [ 58.771902] btrfs_ioctl+0x4caa/0x114e0 [btrfs] ... [ 58.773337] Freed by task 23683: ... [ 58.774815] kfree+0xda/0x2b0 [ 58.775038] free_reloc_control+0x1d6/0x220 [btrfs] [ 58.775465] btrfs_relocate_block_group+0x115c/0x1e20 [btrfs] [ 58.775944] btrfs_relocate_chunk+0xf1/0x760 [btrfs] [ 58.776369] __btrfs_balance+0x1326/0x1f10 [btrfs] [ 58.776784] btrfs_balance+0x3150/0x3d30 [btrfs] [ 58.777185] btrfs_ioctl_balance+0xd84/0x1410 [btrfs] [ 58.777621] btrfs_ioctl+0x4caa/0x114e0 [btrfs] ...
Source: the CVE record as published by its numbering authority, via NVD and CVE.org.
The underlying weakness: Use After Free
The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory belongs to the code that operates on the new pointer.
How developers prevent this class of flaw
- Choose a language that provides automatic memory management.
- When freeing pointers, be sure to set them to NULL once they are freed. However, the utilization of multiple or complex data structures may lower the usefulness of this strategy.
Timeline
- CVE record published.
- Record last changed materially (score, affected products, status or references).
References
Patches and release notes
- git.kernel.org/stable/c/5d741afed0bac206640cc64d77b97853283cf719
- git.kernel.org/stable/c/78f8c2370e3d33e35f23bdc648653d779aeacb6e
- git.kernel.org/stable/c/85f02d6c856b9f3a0acf5219de6e32f58b9778eb
- git.kernel.org/stable/c/8e546674031fc1576da501e27a8fd165222e5a37
- git.kernel.org/stable/c/b60e862e133f646f19023ece1d476d630a660de1
- git.kernel.org/stable/c/dcb11fe0a0a9cca2b7425191b9bf30dc29f2ad0f
- git.kernel.org/stable/c/ff0e8ed8dfb584575cffc1561f17a1d094e8565b
Recent Use After Free vulnerabilities
- 8.8 High severity
- 7.8 High severity
- 7.8 High severity
- 7.8 High severity
- 7.8 High severity
- 7.8 High severity
Spotted an error? Tell us.