PT-2025-8457 · Linux+2 · Linux Kernel+2
Zheyu Ma
·
Published
2022-04-24
·
Updated
2025-04-16
·
CVE-2022-49524
CVSS v3.1
7.8
High
| Vector | AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Linux kernel (affected versions not specified)
Description
A bug in the Linux kernel has been identified, specifically in the cx23885 driver. The issue arises when the driver fails to call the
dma set mask() function, resulting in a use-after-free error. This error occurs because the driver initializes i2c-related resources in cx23885 dev setup() but fails to release them during error handling. The error is evident in the kernel log, showing a BUG: KASAN: use-after-free message.Recommendations
To resolve this issue, modify the error path in the cx23885 driver to properly release i2c-related resources after failing to call
dma set mask(). As a temporary workaround, consider disabling the cx23885 initdev() function until a patch is available. Restrict access to the vulnerable cx23885 driver to minimize the risk of exploitation.Exploit
Fix
Use After Free
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Astra Linux
Linux Kernel
Suse