CVE-2022-4696Release of Invalid Pointer or Reference in Kernel

Severity
7.8HIGHNVD
EPSS
0.0%
top 96.32%
CISA KEV
Not in KEV
Exploit
No known exploits
Timeline
PublishedJan 11
Latest updateApr 1

Description

There exists a use-after-free vulnerability in the Linux kernel through io_uring and the IORING_OP_SPLICE operation. If IORING_OP_SPLICE is missing the IO_WQ_WORK_FILES flag, which signals that the operation won't use current->nsproxy, so its reference counter is not increased. This assumption is not always true as calling io_splice on specific files will call the get_uts function which will use current->nsproxy leading to invalidly decreasing its reference counter later causing the use-after-fr

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 1.8 | Impact: 5.9

Affected Packages8 packages

NVDlinux/linux_kernel5.105.12
Debianlinux/linux_kernel< 5.10.162-1+3
CVEListV5linux/linux_kernel5.7-rc15.10.159
debiandebian/linux< linux 5.14.6-1 (bookworm)

Patches

🔴Vulnerability Details

3
OSV
CVE-2022-4696: In static initializers of io_uring2023-04-01
OSV
CVE-2022-4696: There exists a use-after-free vulnerability in the Linux kernel through io_uring and the IORING_OP_SPLICE operation2023-01-11
GHSA
GHSA-8vjx-3vgx-66mx: There exists a use-after-free vulnerability in the Linux kernel through io_uring and the IORING_OP_SPLICE operation2023-01-11

📋Vendor Advisories

4
Android
CVE-2022-4696: io_uring2023-04-01
Microsoft
There exists a use-after-free vulnerability in the Linux kernel through io_uring and the IORING_OP_SPLICE operation. If IORING_OP_SPLICE is missing the IO_WQ_WORK_FILES flag which signals that the ope2023-01-10
Red Hat
kernel: user-after-free during IORING_OP_SPLICE operation2022-12-19
Debian
CVE-2022-4696: linux - There exists a use-after-free vulnerability in the Linux kernel through io_uring...2022
CVE-2022-4696 — Release of Invalid Pointer or Reference | cvebase