PT-2025-18616 · Linux+1 · Linux Kernel+1

Published 2025-05-01 · Updated 2025-05-02 · CVE-2022-49899

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A vulnerability in the Linux kernel has been resolved. The issue was related to the use of the keyrings subsystem for managing fscrypt master key structs. This approach led to several problems, including the inability to guarantee the destruction of master keys, potential deadlocks, and undesirable delays in key destruction. The vulnerability allowed for a use-after-free condition and made it difficult to ensure that all secrets were wiped. The fix involves changing the implementation to store master key structs in a regular kernel data structure and reworking the reference counting, locking, and lifetime accordingly.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Related Identifiers

CVE-2022-49899

Affected Products

Astra Linux

Linux Kernel

References · 15

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/49xxx/CVE-2022-49899.json · Exploit
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-49899 · Vendor Advisory
• https://git.kernel.org/stable/c/68d15d6558a386f46d815a6ac39edecad713a1bf · Patch
• https://ubuntu.com/security/CVE-2022-49899 · Vendor Advisory
• https://git.kernel.org/stable/c/d7e7b9af104c7b389a0c21eb26532511bce4b510 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-49899 · Security Note
• https://osv.dev/vulnerability/CVE-2022-49899 · Vendor Advisory
• https://git.kernel.org/stable/c/391cceee6d435e616f68631e68f5b32d480b1e67 · Patch
• https://git.kernel.org/stable/c/e6f4fd85ef1ee6ab356bfbd64df28c1cb73aee7e · Patch
• https://security-tracker.debian.org/tracker/CVE-2022-49899 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2022-49899 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-49899 · Vendor Advisory
• https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git · Note
• https://twitter.com/CVEnew/status/1917950819967865118 · Twitter Post
• https://git.kernel.org/linus/d7e7b9af104c7b389a0c21eb26532511bce4b510 · Note