Linux: Double Free
CVE-2022-50401 is a high-severity double free vulnerability in Linux, with a CVSS 3.1 base score of 7.8 out of 10. It can be exploited with local access to the system by an attacker with a low-privileged account, without any action from a user. The record lists versions 707bcca9616002d204091ca7c4d1d91151104332, 15fc60aa5bdcf6d5f93000d3d00579fc67632ee0, 9b4ae8c42d2ff09ed7c5832ccce5684c55e5ed23 as the first without the flaw, so updating Linux to one of those releases or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 0.44% chance of exploitation within 30 days, which is low compared with other CVEs.
High severity with no evidence of exploitation so far.
What to do
- Update Linux to 707bcca9616002d204091ca7c4d1d91151104332 or 15fc60aa5bdcf6d5f93000d3d00579fc67632ee0 or 9b4ae8c42d2ff09ed7c5832ccce5684c55e5ed23 or fddac3b4578d302ac9e51e7f03a9aae6254ae2a3, whichever matches your release line, or a later version.
- Update Linux Kernel to 4.5 or 4.9.337 or 4.14.303 or 4.19.270, whichever matches your release line, or a later version.
Affected products and versions
| Vendor | Product | Affected versions | Fixed in |
|---|---|---|---|
| Linux | Linux | 69151594c72a1748cf93ae5b5fa68d5084253dce up to, but not including, 707bcca9616002d204091ca7c4d1d91151104332; 0c4fb76c4e711d9e4e70ddc6732310a17076175d up to, but not including, 15fc60aa5bdcf6d5f93000d3d00579fc67632ee0; 22c721560ef24003bcb9c3d9c358841dcfa4e212 up to, but not including, 9b4ae8c42d2ff09ed7c5832ccce5684c55e5ed23; e8cac2e3067e8587f8271c2177cc5ca924a61b54 up to, but not including, fddac3b4578d302ac9e51e7f03a9aae6254ae2a3; a4abc6b12eb1f7a533c2e7484cfa555454ff0977 up to, but not including, c1207219a4bfa50121c9345d5d165470d0a82531; a4abc6b12eb1f7a533c2e7484cfa555454ff0977 up to, but not including, a472f069ced8601979f53c13c0cf20236074ed46; a4abc6b12eb1f7a533c2e7484cfa555454ff0977 up to, but not including, e2f9f03e4537f3fcc8fd2bdd3248530c3477a371; a4abc6b12eb1f7a533c2e7484cfa555454ff0977 up to, but not including, d843ebd860c58a38e45527e8ec6516059f4c97f3; and 10 more ranges | 707bcca9616002d204091ca7c4d1d91151104332, 15fc60aa5bdcf6d5f93000d3d00579fc67632ee0, 9b4ae8c42d2ff09ed7c5832ccce5684c55e5ed23, fddac3b4578d302ac9e51e7f03a9aae6254ae2a3, c1207219a4bfa50121c9345d5d165470d0a82531, a472f069ced8601979f53c13c0cf20236074ed46 |
| Linux | Linux Kernel | 4.4.229 up to, but not including, 4.5; 4.9.229 up to, but not including, 4.9.337; 4.14.186 up to, but not including, 4.14.303; 4.19.130 up to, but not including, 4.19.270; 5.4.49 up to, but not including, 5.4.229; 5.7.6 up to, but not including, 5.10.163; 5.11 up to, but not including, 5.15.86; 5.16 up to, but not including, 6.0.16; and 1 more ranges | 4.5, 4.9.337, 4.14.303, 4.19.270, 5.4.229, 5.10.163 |
Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.
How the severity score breaks down
- Attack vector
- LocalThe attacker needs local access or must trick a user into running something.
- Attack complexity
- LowNo special conditions are needed; the attack works reliably.
- Privileges required
- LowA basic user account is enough.
- User interaction
- NoneNo action by a victim is required.
- Scope
- UnchangedImpact stays within the vulnerable component.
- Confidentiality
- HighAll data handled by the component can be read.
- Integrity
- HighData or code can be modified at will.
- Availability
- HighThe component can be taken down completely.
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. Scored by NVD.
| Scoring system | Score | Severity | Scored by |
|---|---|---|---|
| CVSS 3.1 | 9.8 | Critical | CNA |
| CVSS 3.1 | 7.8 | High | NVD |
| CVSS 3.1 | 7.8 | High | CISA (ADP) |
Official description
In the Linux kernel, the following vulnerability has been resolved: nfsd: under NFSv4.1, fix double svc_xprt_put on rpc_create failure On error situation `clp->cl_cb_conn.cb_xprt` should not be given a reference to the xprt otherwise both client cleanup and the error handling path of the caller call to put it. Better to delay handing over the reference to a later branch. [ 72.530665] refcount_t: underflow; use-after-free. [ 72.531933] WARNING: CPU: 0 PID: 173 at lib/refcount.c:28 refcount_warn_saturate+0xcf/0x120 [ 72.533075] Modules linked in: nfsd(OE) nfsv4(OE) nfsv3(OE) nfs(OE) lockd(OE) compat_nfs_ssc(OE) nfs_acl(OE) rpcsec_gss_krb5(OE) auth_rpcgss(OE) rpcrdma(OE) dns_resolver fscache netfs grace rdma_cm iw_cm ib_cm sunrpc(OE) mlx5_ib mlx5_core mlxfw pci_hyperv_intf ib_uverbs ib_core xt_MASQUERADE nf_conntrack_netlink nft_counter xt_addrtype nft_compat br_netfilter bridge stp llc nft_reject_inet nf_reject_ipv4 nf_reject_ipv6 nft_reject nft_ct nft_chain_nat nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 ip_set overlay nf_tables nfnetlink crct10dif_pclmul crc32_pclmul ghash_clmulni_intel xfs serio_raw virtio_net virtio_blk net_failover failover fuse [last unloaded: sunrpc] [ 72.540389] CPU: 0 PID: 173 Comm: kworker/u16:5 Tainted: G OE 5.15.82-dan #1 [ 72.541511] Hardware name: Red Hat KVM/RHEL-AV, BIOS 1.16.0-3.module+el8.7.0+1084+97b81f61 04/01/2014 [ 72.542717] Workqueue: nfsd4_callbacks nfsd4_run_cb_work [nfsd] [ 72.543575] RIP: 0010:refcount_warn_saturate+0xcf/0x120 [ 72.544299] Code: 55 00 0f 0b 5d e9 01 50 98 00 80 3d 75 9e 39 08 00 0f 85 74 ff ff ff 48 c7 c7 e8 d1 60 8e c6 05 61 9e 39 08 01 e8 f6 51 55 00 <0f> 0b 5d e9 d9 4f 98 00 80 3d 4b 9e 39 08 00 0f 85 4c ff ff ff 48 [ 72.546666] RSP: 0018:ffffb3f841157cf0 EFLAGS: 00010286 [ 72.547393] RAX: 0000000000000026 RBX: ffff89ac6231d478 RCX: 0000000000000000 [ 72.548324] RDX: ffff89adb7c2c2c0 RSI: ffff89adb7c205c0 RDI: ffff89adb7c205c0 [ 72.549271] RBP: ffffb3f841157cf0 R08: 0000000000000000 R09: c0000000ffefffff [ 72.550209] R10: 0000000000000001 R11: ffffb3f841157ad0 R12: ffff89ac6231d180 [ 72.551142] R13: ffff89ac6231d478 R14: ffff89ac40c06180 R15: ffff89ac6231d4b0 [ 72.552089] FS: 0000000000000000(0000) GS:ffff89adb7c00000(0000) knlGS:0000000000000000 [ 72.553175] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 72.553934] CR2: 0000563a310506a8 CR3: 0000000109a66000 CR4: 0000000000350ef0 [ 72.554874] Call Trace: [ 72.555278] <TASK> [ 72.555614] svc_xprt_put+0xaf/0xe0 [sunrpc] [ 72.556276] nfsd4_process_cb_update.isra.11+0xb7/0x410 [nfsd] [ 72.557087] ? update_load_avg+0x82/0x610 [ 72.557652] ? cpuacct_charge+0x60/0x70 [ 72.558212] ? dequeue_entity+0xdb/0x3e0 [ 72.558765] ? queued_spin_unlock+0x9/0x20 [ 72.559358] nfsd4_run_cb_work+0xfc/0x270 [nfsd] [ 72.560031] process_one_work+0x1df/0x390 [ 72.560600] worker_thread+0x37/0x3b0 [ 72.561644] ? process_one_work+0x390/0x390 [ 72.562247] kthread+0x12f/0x150 [ 72.562710] ? set_kthread_struct+0x50/0x50 [ 72.563309] ret_from_fork+0x22/0x30 [ 72.563818] </TASK> [ 72.564189] ---[ end trace 031117b1c72ec616 ]--- [ 72.566019] list_add corruption. next->prev should be prev (ffff89ac4977e538), but was ffff89ac4763e018. (next=ffff89ac4763e018). [ 72.567647] ------------[ cut here ]------------
Source: the CVE record as published by its numbering authority, via NVD and CVE.org.
The underlying weakness: Double Free
The product calls free() twice on the same memory address.
How developers prevent this class of flaw
- Choose a language that provides automatic memory management.
- Ensure that each allocation is freed only once. After freeing a chunk, set the pointer to NULL to ensure the pointer cannot be freed again. In complicated error conditions, be sure that clean-up routines respect the state of allocation properly. If the language is object oriented, ensure that object destructors delete each chunk of memory only once.
- Use a static analysis tool to find double free instances.
Timeline
- CVE record published.
- CISA published its SSVC assessment (exploitation: none, automatable: no, technical impact: total).
- Record last changed materially (score, affected products, status or references).
References
Patches and release notes
- git.kernel.org/stable/c/15fc60aa5bdcf6d5f93000d3d00579fc67632ee0
- git.kernel.org/stable/c/3bc8edc98bd43540dbe648e4ef91f443d6d20a24
- git.kernel.org/stable/c/707bcca9616002d204091ca7c4d1d91151104332
- git.kernel.org/stable/c/9b4ae8c42d2ff09ed7c5832ccce5684c55e5ed23
- git.kernel.org/stable/c/a472f069ced8601979f53c13c0cf20236074ed46
- git.kernel.org/stable/c/c1207219a4bfa50121c9345d5d165470d0a82531
- git.kernel.org/stable/c/d843ebd860c58a38e45527e8ec6516059f4c97f3
- git.kernel.org/stable/c/e2f9f03e4537f3fcc8fd2bdd3248530c3477a371
- git.kernel.org/stable/c/fddac3b4578d302ac9e51e7f03a9aae6254ae2a3
Recent Double Free vulnerabilities
- 7.8 High severity
- 7.8 High severity
- 7.8 High severity
- 7.8 High severity
- 7.8 High severity
- 7.8 High severity
Spotted an error? Tell us.