PT-2022-7703 · Linux+1 · Linux Kernel+1

Bing-Jhong Billy Jheng · Published 2022-07-22 · Updated 2023-02-03 · CVE-2022-2327

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to the version containing commit df3f3bb5059d20ef094d6b2f0256c4bf4127a859

Description The issue is related to a double free vulnerability in the Linux kernel, specifically with the io uring feature. This vulnerability can be exploited to cause a denial of service. The io uring use work flags to determine which identity needs to be grabbed from the calling process to ensure consistency when executing IORING OP. However, some operations are missing certain types, leading to incorrect reference counts and potentially resulting in a double free.

Recommendations To resolve the issue, upgrade the kernel past commit df3f3bb5059d20ef094d6b2f0256c4bf4127a859. As a temporary workaround, consider restricting the use of the io uring feature until a patch is available.

Fix

Use After Free

Double Free

Weakness Enumeration

CWE-416

CWE-415

Related Identifiers

BDU:2025-00784

CVE-2022-2327

OESA-2022-1824

Affected Products

Astra Linux

Linux Kernel

References · 22

• https://nvd.nist.gov/vuln/detail/CVE-2022-2327 · Security Note
• https://cve.org/CVERecord?id=CVE-2022-2327 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2022-2327 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-2639 · Security Note
• https://wiki.astralinux.ru/astra-linux-se81-bulletin-20241206SE81 · Vendor Advisory
• https://kernel.dance/#df3f3bb5059d20ef094d6b2f0256c4bf4127a859 · Patch
• https://osv.dev/vulnerability/OESA-2022-1824 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-2327 · Vendor Advisory
• https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=linux-5.10.y&id=df3f3bb5059d20ef094d6b2f0256c4bf4127a859 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-2327 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-00784 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-2327 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-2327 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-1679 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-36946 · Security Note