PT-2022-7610 · Linux+3 · Linux Kernel+3
Published
2022-01-17
·
Updated
2024-12-04
·
CVE-2022-48759
CVSS v3.1
7.0
High
| Vector | AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Linux kernel versions prior to 5.4.163-lockdep #26
Description
The issue is related to a race condition between the release of
rpmsg ctrldev and cdev in the Linux kernel. The current code frees the rpmsg ctrldev struct in rpmsg ctrldev release device(), but the cdev is a managed object, and its release is not predictable. This can cause the rpmsg ctrldev to be freed before the cdev is entirely released. The cdev device add/del() API was created to address this issue.Recommendations
To resolve this issue, use the
cdev device add/del() API instead of cdev add/del(). This API was created to address the race condition between the release of rpmsg ctrldev and cdev. By using this API, you can ensure that the cdev is properly released before the rpmsg ctrldev is freed.Exploit
Fix
Use After Free
Race Condition
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Astra Linux
Linux Kernel
Red Os
Suse