CVE-2022-49076

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2022-49076
In the Linux kernel, the following vulnerability has been resolved: RDMA/hfi1: Fix use-after-free bug for mm struct Under certain conditions, such as MPI_Abort, the hfi1 cleanup code may represent the last reference held on the task mm. hfi1_mmu_rb_unregister() then drops the last reference and the mm is freed before the final use in hfi1_release_user_pages(). A new task may allocate the mm structure while it is still being used, resulting in problems. One manifestation is corruption of the mmap_sem counter leading to a hang in down_write(). Another is corruption of an mm struct that is in use by another task.

7.8 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/0b7186d657ee55e2cdefae498f07d5c1961e8023 Patch
https://git.kernel.org/stable/c/2bbac98d0930e8161b1957dc0ec99de39ade1b3c Patch
https://git.kernel.org/stable/c/5a9a1b24ddb510715f8f621263938186579a965c Patch
https://git.kernel.org/stable/c/5f54364ff6cfcd14cddf5441c4a490bb28dd69f7 Patch
https://git.kernel.org/stable/c/9ca11bd8222a612de0d2f54d050bfcf61ae2883f Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.18:rc1:*:*:*:*:*:*
History

24 Mar 2025, 17:42

Type Values Removed Values Added
References () https://git.kernel.org/stable/c/0b7186d657ee55e2cdefae498f07d5c1961e8023 - () https://git.kernel.org/stable/c/0b7186d657ee55e2cdefae498f07d5c1961e8023 - Patch
References () https://git.kernel.org/stable/c/2bbac98d0930e8161b1957dc0ec99de39ade1b3c - () https://git.kernel.org/stable/c/2bbac98d0930e8161b1957dc0ec99de39ade1b3c - Patch
References () https://git.kernel.org/stable/c/5a9a1b24ddb510715f8f621263938186579a965c - () https://git.kernel.org/stable/c/5a9a1b24ddb510715f8f621263938186579a965c - Patch
References () https://git.kernel.org/stable/c/5f54364ff6cfcd14cddf5441c4a490bb28dd69f7 - () https://git.kernel.org/stable/c/5f54364ff6cfcd14cddf5441c4a490bb28dd69f7 - Patch
References () https://git.kernel.org/stable/c/9ca11bd8222a612de0d2f54d050bfcf61ae2883f - () https://git.kernel.org/stable/c/9ca11bd8222a612de0d2f54d050bfcf61ae2883f - Patch
First Time Linux linux Kernel
Linux
CPE cpe:2.3:o:linux:linux_kernel:5.18:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*

27 Feb 2025, 19:15

Type Values Removed Values Added
CWE CWE-416
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 7.8
Summary
  • (es) En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: RDMA/hfi1: Se corrige el error de use-after-free para la estructura mm En determinadas condiciones, como MPI_Abort, el código de limpieza hfi1 puede representar la última referencia retenida en la tarea mm. Luego, hfi1_mmu_rb_unregister() elimina la última referencia y la mm se libera antes del uso final en hfi1_release_user_pages(). Una nueva tarea puede asignar la estructura mm mientras aún se está utilizando, lo que genera problemas. Una manifestación es la corrupción del contador mmap_sem que provoca un bloqueo en down_write(). Otra es la corrupción de una estructura mm que está en uso por otra tarea.

26 Feb 2025, 07:00

Type Values Removed Values Added
New CVE
Information

Published : 2025-02-26 07:00

Updated : 2025-03-24 17:42

NVD link : CVE-2022-49076

Mitre link : CVE-2022-49076

CVE.ORG link : CVE-2022-49076

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
CWE-416

Use After Free