PT-2022-7378 · Linux+6 · Linux Kernel+6

Gao Xiang · Published 2022-09-05 · Updated 2026-03-14 · CVE-2022-48674

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description The issue is related to a use-after-free vulnerability in the erofs file system, specifically in the erofs workgroup unfreeze() function. This vulnerability can cause a race condition, allowing an attacker to potentially impact the confidentiality, integrity, and availability of protected information. The root cause is that erofs workgroup unfreeze() doesn't reset to orig val, thus causing the pcluster to reuse unexpectedly before freeing. This path is considered unnecessary since UP platforms are quite rare now.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Use After Free

Weakness Enumeration

CWE-416

Related Identifiers

BDU:2024-04573

CVE-2022-48674

OESA-2024-1617

OESA-2024-1618

OESA-2024-1622

OPENSUSE-SU-2024_4315-1

OPENSUSE-SU-2024_4376-1

SUSE-SU-2024:4315-1

SUSE-SU-2024:4364-1

SUSE-SU-2024:4376-1

USN-6951-1

USN-6951-2

USN-6951-3

USN-6951-4

USN-6953-1

USN-6979-1

Affected Products

Astra Linux

Debian

Linuxmint

Linux Kernel

Red Os

Suse

Ubuntu

References · 1178

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/48xxx/CVE-2022-48674.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2023-52644 · Security Note
• https://ubuntu.com/security/CVE-2024-27398 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-26740 · Security Note
• https://ubuntu.com/security/CVE-2024-38780 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-48674 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-39489 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-26895 · Security Note
• https://osv.dev/vulnerability/OESA-2024-1622 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-48655 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-26805 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-26814 · Security Note
• https://ubuntu.com/security/CVE-2024-38634 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-6951-3 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-6951-4 · Vendor Advisory