CVE-2022-48740

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2022-48740
In the Linux kernel, the following vulnerability has been resolved: selinux: fix double free of cond_list on error paths On error path from cond_read_list() and duplicate_policydb_cond_list() the cond_list_destroy() gets called a second time in caller functions, resulting in NULL pointer deref. Fix this by resetting the cond_list_len to 0 in cond_list_destroy(), making subsequent calls a noop. Also consistently reset the cond_list pointer to NULL after freeing. [PM: fix line lengths in the description]

7.8 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/186edf7e368c40d06cf727a1ad14698ea67b74ad Patch
https://git.kernel.org/stable/c/70caa32e6d81f45f0702070c0e4dfe945e92fbd7 Patch
https://git.kernel.org/stable/c/7ed9cbf7ac0d4ed86b356e1b944304ae9ee450d4 Patch
https://git.kernel.org/stable/c/f446089a268c8fc6908488e991d28a9b936293db Patch
https://git.kernel.org/stable/c/186edf7e368c40d06cf727a1ad14698ea67b74ad Patch
https://git.kernel.org/stable/c/70caa32e6d81f45f0702070c0e4dfe945e92fbd7 Patch
https://git.kernel.org/stable/c/7ed9cbf7ac0d4ed86b356e1b944304ae9ee450d4 Patch
https://git.kernel.org/stable/c/f446089a268c8fc6908488e991d28a9b936293db Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.17:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.17:rc2:*:*:*:*:*:*
History

27 May 2025, 18:31

Type Values Removed Values Added
CPE cpe:2.3:o:linux:linux_kernel:5.17:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.17:rc1:*:*:*:*:*:*

21 Nov 2024, 07:33

Type Values Removed Values Added
References () https://git.kernel.org/stable/c/186edf7e368c40d06cf727a1ad14698ea67b74ad - Patch () https://git.kernel.org/stable/c/186edf7e368c40d06cf727a1ad14698ea67b74ad - Patch
References () https://git.kernel.org/stable/c/70caa32e6d81f45f0702070c0e4dfe945e92fbd7 - Patch () https://git.kernel.org/stable/c/70caa32e6d81f45f0702070c0e4dfe945e92fbd7 - Patch
References () https://git.kernel.org/stable/c/7ed9cbf7ac0d4ed86b356e1b944304ae9ee450d4 - Patch () https://git.kernel.org/stable/c/7ed9cbf7ac0d4ed86b356e1b944304ae9ee450d4 - Patch
References () https://git.kernel.org/stable/c/f446089a268c8fc6908488e991d28a9b936293db - Patch () https://git.kernel.org/stable/c/f446089a268c8fc6908488e991d28a9b936293db - Patch

19 Aug 2024, 17:03

Type Values Removed Values Added
References () https://git.kernel.org/stable/c/186edf7e368c40d06cf727a1ad14698ea67b74ad - () https://git.kernel.org/stable/c/186edf7e368c40d06cf727a1ad14698ea67b74ad - Patch
References () https://git.kernel.org/stable/c/70caa32e6d81f45f0702070c0e4dfe945e92fbd7 - () https://git.kernel.org/stable/c/70caa32e6d81f45f0702070c0e4dfe945e92fbd7 - Patch
References () https://git.kernel.org/stable/c/7ed9cbf7ac0d4ed86b356e1b944304ae9ee450d4 - () https://git.kernel.org/stable/c/7ed9cbf7ac0d4ed86b356e1b944304ae9ee450d4 - Patch
References () https://git.kernel.org/stable/c/f446089a268c8fc6908488e991d28a9b936293db - () https://git.kernel.org/stable/c/f446089a268c8fc6908488e991d28a9b936293db - Patch
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 7.8
CPE cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
CWE CWE-415
First Time Linux
Linux linux Kernel
Summary
  • (es) En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: selinux: corrige el doble libre de cond_list en rutas de error En la ruta de error de cond_read_list() y duplicado_policydb_cond_list(), se llama a cond_list_destroy() por segunda vez en las funciones de llamada, lo que resulta en un puntero NULL deref. Solucione este problema restableciendo cond_list_len a 0 en cond_list_destroy(), haciendo que las llamadas posteriores sean un error. También restablezca constantemente el puntero cond_list a NULL después de liberarlo. [PM: corrija la longitud de las líneas en la descripción]

20 Jun 2024, 12:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-06-20 12:15

Updated : 2025-05-27 18:31

NVD link : CVE-2022-48740

Mitre link : CVE-2022-48740

CVE.ORG link : CVE-2022-48740

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
CWE-415

Double Free