Linux: Use After Free
CVE-2022-50432 is a high-severity use after free vulnerability in Linux, with a CVSS 3.1 base score of 7.8 out of 10. It can be exploited with local access to the system by an attacker with a low-privileged account, without any action from a user. The record lists versions 4dfd6a477a1525773469feaf3c514b2c0fef76b5, 02eb35131050735332658029082f61515b7dfe38, 028cf780743eea79abffa7206b9dcfc080ad3546 as the first without the flaw, so updating Linux to one of those releases or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 0.16% chance of exploitation within 30 days, which is low compared with other CVEs.
High severity with no evidence of exploitation so far.
What to do
- Update Linux to 4dfd6a477a1525773469feaf3c514b2c0fef76b5 or 02eb35131050735332658029082f61515b7dfe38 or 028cf780743eea79abffa7206b9dcfc080ad3546 or c78b0dc6fb7fb389d674e491fd376388cdfb1d53, whichever matches your release line, or a later version.
- Update Linux Kernel to 4.9.332 or 4.14.298 or 4.19.264 or 5.4.223, whichever matches your release line, or a later version.
Affected products and versions
| Vendor | Product | Affected versions | Fixed in |
|---|---|---|---|
| Linux | Linux | 45a140e587f3d32d8d424ed940dffb61e1739047 up to, but not including, 4dfd6a477a1525773469feaf3c514b2c0fef76b5; 45a140e587f3d32d8d424ed940dffb61e1739047 up to, but not including, 02eb35131050735332658029082f61515b7dfe38; 45a140e587f3d32d8d424ed940dffb61e1739047 up to, but not including, 028cf780743eea79abffa7206b9dcfc080ad3546; 45a140e587f3d32d8d424ed940dffb61e1739047 up to, but not including, c78b0dc6fb7fb389d674e491fd376388cdfb1d53; 45a140e587f3d32d8d424ed940dffb61e1739047 up to, but not including, 6f72a3977ba9d0e5491a5c01315204272e7f9c44; 45a140e587f3d32d8d424ed940dffb61e1739047 up to, but not including, 94d2643df1e70a4c310ebb5e2c493eec33df1a06; 45a140e587f3d32d8d424ed940dffb61e1739047 up to, but not including, af1b57cc39beca203559576b3046094fc9e5eb32; 45a140e587f3d32d8d424ed940dffb61e1739047 up to, but not including, 4abc99652812a2ddf932f137515d5c5a04723538; and 1 more ranges | 4dfd6a477a1525773469feaf3c514b2c0fef76b5, 02eb35131050735332658029082f61515b7dfe38, 028cf780743eea79abffa7206b9dcfc080ad3546, c78b0dc6fb7fb389d674e491fd376388cdfb1d53, 6f72a3977ba9d0e5491a5c01315204272e7f9c44, 94d2643df1e70a4c310ebb5e2c493eec33df1a06 |
| Linux | Linux Kernel | 3.14 up to, but not including, 4.9.332; 4.10 up to, but not including, 4.14.298; 4.15 up to, but not including, 4.19.264; 4.20 up to, but not including, 5.4.223; 5.5 up to, but not including, 5.10.153; 5.11 up to, but not including, 5.15.77; 5.16 up to, but not including, 6.0.7 | 4.9.332, 4.14.298, 4.19.264, 5.4.223, 5.10.153, 5.15.77 |
Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.
How the severity score breaks down
- Attack vector
- LocalThe attacker needs local access or must trick a user into running something.
- Attack complexity
- LowNo special conditions are needed; the attack works reliably.
- Privileges required
- LowA basic user account is enough.
- User interaction
- NoneNo action by a victim is required.
- Scope
- UnchangedImpact stays within the vulnerable component.
- Confidentiality
- HighAll data handled by the component can be read.
- Integrity
- HighData or code can be modified at will.
- Availability
- HighThe component can be taken down completely.
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. Scored by NVD.
| Scoring system | Score | Severity | Scored by |
|---|---|---|---|
| CVSS 3.1 | 7.8 | High | CNA |
| CVSS 3.1 | 7.8 | High | NVD |
Official description
In the Linux kernel, the following vulnerability has been resolved: kernfs: fix use-after-free in __kernfs_remove Syzkaller managed to trigger concurrent calls to kernfs_remove_by_name_ns() for the same file resulting in a KASAN detected use-after-free. The race occurs when the root node is freed during kernfs_drain(). To prevent this acquire an additional reference for the root of the tree that is removed before calling __kernfs_remove(). Found by syzkaller with the following reproducer (slab_nomerge is required): syz_mount_image$ext4(0x0, &(0x7f0000000100)='./file0\x00', 0x100000, 0x0, 0x0, 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='/proc/self/exe\x00', 0x0, 0x0) close(r0) pipe2(&(0x7f0000000140)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x800) mount$9p_fd(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f00000000c0), 0x408, &(0x7f0000000280)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c, {[{@cache_loose}, {@mmap}, {@loose}, {@loose}, {@mmap}], [{@mask={'mask', 0x3d, '^MAY_EXEC'}}, {@fsmagic={'fsmagic', 0x3d, 0x10001}}, {@dont_hash}]}}) Sample report: ================================================================== BUG: KASAN: use-after-free in kernfs_type include/linux/kernfs.h:335 [inline] BUG: KASAN: use-after-free in kernfs_leftmost_descendant fs/kernfs/dir.c:1261 [inline] BUG: KASAN: use-after-free in __kernfs_remove.part.0+0x843/0x960 fs/kernfs/dir.c:1369 Read of size 2 at addr ffff8880088807f0 by task syz-executor.2/857 CPU: 0 PID: 857 Comm: syz-executor.2 Not tainted 6.0.0-rc3-00363-g7726d4c3e60b #5 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014 Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x6e/0x91 lib/dump_stack.c:106 print_address_description mm/kasan/report.c:317 [inline] print_report.cold+0x5e/0x5e5 mm/kasan/report.c:433 kasan_report+0xa3/0x130 mm/kasan/report.c:495 kernfs_type include/linux/kernfs.h:335 [inline] kernfs_leftmost_descendant fs/kernfs/dir.c:1261 [inline] __kernfs_remove.part.0+0x843/0x960 fs/kernfs/dir.c:1369 __kernfs_remove fs/kernfs/dir.c:1356 [inline] kernfs_remove_by_name_ns+0x108/0x190 fs/kernfs/dir.c:1589 sysfs_slab_add+0x133/0x1e0 mm/slub.c:5943 __kmem_cache_create+0x3e0/0x550 mm/slub.c:4899 create_cache mm/slab_common.c:229 [inline] kmem_cache_create_usercopy+0x167/0x2a0 mm/slab_common.c:335 p9_client_create+0xd4d/0x1190 net/9p/client.c:993 v9fs_session_init+0x1e6/0x13c0 fs/9p/v9fs.c:408 v9fs_mount+0xb9/0xbd0 fs/9p/vfs_super.c:126 legacy_get_tree+0xf1/0x200 fs/fs_context.c:610 vfs_get_tree+0x85/0x2e0 fs/super.c:1530 do_new_mount fs/namespace.c:3040 [inline] path_mount+0x675/0x1d00 fs/namespace.c:3370 do_mount fs/namespace.c:3383 [inline] __do_sys_mount fs/namespace.c:3591 [inline] __se_sys_mount fs/namespace.c:3568 [inline] __x64_sys_mount+0x282/0x300 fs/namespace.c:3568 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x38/0x90 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd RIP: 0033:0x7f725f983aed Code: 02 b8 ff ff ff ff c3 66 0f 1f 44 00 00 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f725f0f7028 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 RAX: ffffffffffffffda RBX: 00007f725faa3f80 RCX: 00007f725f983aed RDX: 00000000200000c0 RSI: 0000000020000040 RDI: 0000000000000000 RBP: 00007f725f9f419c R08: 0000000020000280 R09: 0000000000000000 R10: 0000000000000408 R11: 0000000000000246 R12: 0000000000000000 R13: 0000000000000006 R14: 00007f725faa3f80 R15: 00007f725f0d7000 </TASK> Allocated by task 855: kasan_save_stack+0x1e/0x40 mm/kasan/common.c:38 kasan_set_track mm/kasan/common.c:45 [inline] set_alloc_info mm/kasan/common.c:437 [inline] __kasan_slab_alloc+0x66/0x80 mm/kasan/common.c:470 kasan_slab_alloc include/linux/kasan.h:224 [inline] slab_post_alloc_hook mm/slab.h:7 ---truncated---
Source: the CVE record as published by its numbering authority, via NVD and CVE.org.
The underlying weakness: Use After Free
The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory belongs to the code that operates on the new pointer.
How developers prevent this class of flaw
- Choose a language that provides automatic memory management.
- When freeing pointers, be sure to set them to NULL once they are freed. However, the utilization of multiple or complex data structures may lower the usefulness of this strategy.
Timeline
- CVE record published.
- CISA published its SSVC assessment (exploitation: none, automatable: no, technical impact: total).
- Record last changed materially (score, affected products, status or references).
References
Patches and release notes
- git.kernel.org/stable/c/028cf780743eea79abffa7206b9dcfc080ad3546
- git.kernel.org/stable/c/02eb35131050735332658029082f61515b7dfe38
- git.kernel.org/stable/c/4abc99652812a2ddf932f137515d5c5a04723538
- git.kernel.org/stable/c/4dfd6a477a1525773469feaf3c514b2c0fef76b5
- git.kernel.org/stable/c/6f72a3977ba9d0e5491a5c01315204272e7f9c44
- git.kernel.org/stable/c/94d2643df1e70a4c310ebb5e2c493eec33df1a06
- git.kernel.org/stable/c/af1b57cc39beca203559576b3046094fc9e5eb32
- git.kernel.org/stable/c/c78b0dc6fb7fb389d674e491fd376388cdfb1d53
Recent Use After Free vulnerabilities
- 8.1 High severity
- 7.8 High severity
- 7.8 High severity
- 7.8 High severity
- 7.8 High severity
- 7.8 High severity
Spotted an error? Tell us.