CVE-2022-48771

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2022-48771
In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: Fix stale file descriptors on failed usercopy A failing usercopy of the fence_rep object will lead to a stale entry in the file descriptor table as put_unused_fd() won't release it. This enables userland to refer to a dangling 'file' object through that still valid file descriptor, leading to all kinds of use-after-free exploitation scenarios. Fix this by deferring the call to fd_install() until after the usercopy has succeeded.

7.8 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/0008a0c78fc33a84e2212a7c04e6b21a36ca6f4d Patch
https://git.kernel.org/stable/c/1d833b27fb708d6fdf5de9f6b3a8be4bd4321565 Patch
https://git.kernel.org/stable/c/6066977961fc6f437bc064f628cf9b0e4571c56c Patch
https://git.kernel.org/stable/c/84b1259fe36ae0915f3d6ddcea6377779de48b82 Patch
https://git.kernel.org/stable/c/a0f90c8815706981c483a652a6aefca51a5e191c Patch
https://git.kernel.org/stable/c/ae2b20f27732fe92055d9e7b350abc5cdf3e2414 Patch
https://git.kernel.org/stable/c/e8d092a62449dcfc73517ca43963d2b8f44d0516 Patch
https://git.kernel.org/stable/c/0008a0c78fc33a84e2212a7c04e6b21a36ca6f4d Patch
https://git.kernel.org/stable/c/1d833b27fb708d6fdf5de9f6b3a8be4bd4321565 Patch
https://git.kernel.org/stable/c/6066977961fc6f437bc064f628cf9b0e4571c56c Patch
https://git.kernel.org/stable/c/84b1259fe36ae0915f3d6ddcea6377779de48b82 Patch
https://git.kernel.org/stable/c/a0f90c8815706981c483a652a6aefca51a5e191c Patch
https://git.kernel.org/stable/c/ae2b20f27732fe92055d9e7b350abc5cdf3e2414 Patch
https://git.kernel.org/stable/c/e8d092a62449dcfc73517ca43963d2b8f44d0516 Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.17:rc1:*:*:*:*:*:*
History

06 Jan 2025, 21:41

Type Values Removed Values Added
References () https://git.kernel.org/stable/c/0008a0c78fc33a84e2212a7c04e6b21a36ca6f4d - () https://git.kernel.org/stable/c/0008a0c78fc33a84e2212a7c04e6b21a36ca6f4d - Patch
References () https://git.kernel.org/stable/c/1d833b27fb708d6fdf5de9f6b3a8be4bd4321565 - () https://git.kernel.org/stable/c/1d833b27fb708d6fdf5de9f6b3a8be4bd4321565 - Patch
References () https://git.kernel.org/stable/c/6066977961fc6f437bc064f628cf9b0e4571c56c - () https://git.kernel.org/stable/c/6066977961fc6f437bc064f628cf9b0e4571c56c - Patch
References () https://git.kernel.org/stable/c/84b1259fe36ae0915f3d6ddcea6377779de48b82 - () https://git.kernel.org/stable/c/84b1259fe36ae0915f3d6ddcea6377779de48b82 - Patch
References () https://git.kernel.org/stable/c/a0f90c8815706981c483a652a6aefca51a5e191c - () https://git.kernel.org/stable/c/a0f90c8815706981c483a652a6aefca51a5e191c - Patch
References () https://git.kernel.org/stable/c/ae2b20f27732fe92055d9e7b350abc5cdf3e2414 - () https://git.kernel.org/stable/c/ae2b20f27732fe92055d9e7b350abc5cdf3e2414 - Patch
References () https://git.kernel.org/stable/c/e8d092a62449dcfc73517ca43963d2b8f44d0516 - () https://git.kernel.org/stable/c/e8d092a62449dcfc73517ca43963d2b8f44d0516 - Patch
CPE cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.17:rc1:*:*:*:*:*:*
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 7.8
CWE CWE-416
First Time Linux linux Kernel
Linux

21 Nov 2024, 07:33

Type Values Removed Values Added
Summary
  • (es) En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: drm/vmwgfx: corrige descriptores de archivos obsoletos en una copia de usuario fallida. Una copia de usuario fallida del objeto valla_rep generará una entrada obsoleta en la tabla de descriptores de archivos, ya que put_unused_fd() no lo liberará. Esto permite al usuario hacer referencia a un objeto 'archivo' pendiente a través de ese descriptor de archivo aún válido, lo que lleva a todo tipo de escenarios de explotación de use-after-free. Solucione este problema posponiendo la llamada a fd_install() hasta que la copia del usuario se haya realizado correctamente.
References () https://git.kernel.org/stable/c/0008a0c78fc33a84e2212a7c04e6b21a36ca6f4d - () https://git.kernel.org/stable/c/0008a0c78fc33a84e2212a7c04e6b21a36ca6f4d -
References () https://git.kernel.org/stable/c/1d833b27fb708d6fdf5de9f6b3a8be4bd4321565 - () https://git.kernel.org/stable/c/1d833b27fb708d6fdf5de9f6b3a8be4bd4321565 -
References () https://git.kernel.org/stable/c/6066977961fc6f437bc064f628cf9b0e4571c56c - () https://git.kernel.org/stable/c/6066977961fc6f437bc064f628cf9b0e4571c56c -
References () https://git.kernel.org/stable/c/84b1259fe36ae0915f3d6ddcea6377779de48b82 - () https://git.kernel.org/stable/c/84b1259fe36ae0915f3d6ddcea6377779de48b82 -
References () https://git.kernel.org/stable/c/a0f90c8815706981c483a652a6aefca51a5e191c - () https://git.kernel.org/stable/c/a0f90c8815706981c483a652a6aefca51a5e191c -
References () https://git.kernel.org/stable/c/ae2b20f27732fe92055d9e7b350abc5cdf3e2414 - () https://git.kernel.org/stable/c/ae2b20f27732fe92055d9e7b350abc5cdf3e2414 -
References () https://git.kernel.org/stable/c/e8d092a62449dcfc73517ca43963d2b8f44d0516 - () https://git.kernel.org/stable/c/e8d092a62449dcfc73517ca43963d2b8f44d0516 -

20 Jun 2024, 12:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-06-20 12:15

Updated : 2025-01-06 21:41

NVD link : CVE-2022-48771

Mitre link : CVE-2022-48771

CVE.ORG link : CVE-2022-48771

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
CWE-416

Use After Free