CVE-2022-4696

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2022-4696
There exists a use-after-free vulnerability in the Linux kernel through io_uring and the IORING_OP_SPLICE operation. If IORING_OP_SPLICE is missing the IO_WQ_WORK_FILES flag, which signals that the operation won't use current->nsproxy, so its reference counter is not increased. This assumption is not always true as calling io_splice on specific files will call the get_uts function which will use current->nsproxy leading to invalidly decreasing its reference counter later causing the use-after-free vulnerability. We recommend upgrading to version 5.10.160 or above

7.8 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=linux-5.10.y&id=75454b4bbfc7e6a4dd8338556f36ea9107ddf61a Mailing List Patch Vendor Advisory
https://kernel.dance/#75454b4bbfc7e6a4dd8338556f36ea9107ddf61a Exploit Third Party Advisory
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=linux-5.10.y&id=75454b4bbfc7e6a4dd8338556f36ea9107ddf61a Mailing List Patch Vendor Advisory
https://kernel.dance/#75454b4bbfc7e6a4dd8338556f36ea9107ddf61a Exploit Third Party Advisory
https://security.netapp.com/advisory/ntap-20230223-0003/
Configurations

Configuration 1 (hide)

cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
History

21 Nov 2024, 07:35

Type Values Removed Values Added
Summary
  • (es) Existe una vulnerabilidad de use-after-free en el kernel de Linux a través de io_uring y la operación IORING_OP_SPLICE. Si a IORING_OP_SPLICE le falta el indicador IO_WQ_WORK_FILES, que indica que la operación no utilizará current->nsproxy, por lo que su contador de referencia no aumenta. Esta suposición no siempre es cierta, ya que llamar a io_splice en archivos específicos llamará a la función get_uts, que utilizará current->nsproxy, lo que provocará una disminución no válida de su contador de referencia y luego provocará la vulnerabilidad de use-after-free. Recomendamos actualizar a la versión 5.10.160 o superior
References
  • () https://security.netapp.com/advisory/ntap-20230223-0003/ -
References () https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=linux-5.10.y&id=75454b4bbfc7e6a4dd8338556f36ea9107ddf61a - Mailing List, Patch, Vendor Advisory () https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=linux-5.10.y&id=75454b4bbfc7e6a4dd8338556f36ea9107ddf61a - Mailing List, Patch, Vendor Advisory
References () https://kernel.dance/#75454b4bbfc7e6a4dd8338556f36ea9107ddf61a - Exploit, Third Party Advisory () https://kernel.dance/#75454b4bbfc7e6a4dd8338556f36ea9107ddf61a - Exploit, Third Party Advisory

07 Nov 2023, 03:58

Type Values Removed Values Added
Summary There exists a use-after-free vulnerability in the Linux kernel through io_uring and the IORING_OP_SPLICE operation. If IORING_OP_SPLICE is missing the IO_WQ_WORK_FILES flag, which signals that the operation won't use current->nsproxy, so its reference counter is not increased. This assumption is not always true as calling io_splice on specific files will call the get_uts function which will use current->nsproxy leading to invalidly decreasing its reference counter later causing the use-after-free vulnerability. We recommend upgrading to version 5.10.160 or above There exists a use-after-free vulnerability in the Linux kernel through io_uring and the IORING_OP_SPLICE operation. If IORING_OP_SPLICE is missing the IO_WQ_WORK_FILES flag, which signals that the operation won't use current->nsproxy, so its reference counter is not increased. This assumption is not always true as calling io_splice on specific files will call the get_uts function which will use current->nsproxy leading to invalidly decreasing its reference counter later causing the use-after-free vulnerability. We recommend upgrading to version 5.10.160 or above

12 May 2023, 13:30

Type Values Removed Values Added
CPE cpe:2.3:o:linux:linux_kernel:5.7:rc1:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Information

Published : 2023-01-11 13:15

Updated : 2024-11-21 07:35

NVD link : CVE-2022-4696

Mitre link : CVE-2022-4696

CVE.ORG link : CVE-2022-4696

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
CWE-763

Release of Invalid Pointer or Reference

CWE-416

Use After Free