PT-2022-7473 · Linux+3 · Linux Kernel+3

Yi Wang

+1

·

Published

2022-03-06

·

Updated

2024-08-29

·

CVE-2022-48861

CVSS v3.1

5.5

Medium

VectorAV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)
Description The issue is related to a use-after-free vulnerability in the Linux kernel's vdpa component. When the vp vdpa driver is unbound, vp vdpa is freed in vdpa unregister device, and then vp vdpa->mdev.pci dev is dereferenced in vp modern remove, triggering use-after-free. This can lead to a denial of service. The vulnerability is triggered by the vp vdpa remove function and the vp modern remove function, which dereferences vp vdpa->mdev.pci dev. The do syscall 64, vfs write, kernfs fop write iter, device release driver internal, pci device remove, vdpa unregister device, kobject release, device release, and kfree functions are involved in the call trace of unbinding the driver and freeing vp vdpa. The pci release selected regions, pci release region, pci resource len, pci resource end, and (dev)->resource[(bar)].end functions are involved in the call trace of dereferencing vp vdpa->mdev.pci dev.
Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Use After Free

Found an issue in the description? Have something to add? Feel free to write us 👾

Weakness Enumeration

Related Identifiers

BDU:2024-06616
CVE-2022-48861
OPENSUSE-SU-2024_2947-1
SUSE-SU-2024:2894-1
SUSE-SU-2024:2902-1
SUSE-SU-2024:2929-1
SUSE-SU-2024:2939-1
SUSE-SU-2024:2947-1

Affected Products

Astra Linux
Linux Kernel
Red Os
Suse