cbcvebase.
CVE-2022-48759
published 2024-06-20

CVE-2022-48759: In the Linux kernel, the following vulnerability has been resolved: rpmsg: char: Fix race between the release of rpmsg_ctrldev and cdev struct rpmsg_ctrldev…

PriorityP429high7CVSS 3.1
AVLACHPRLUINSUCHIHAH
EPSS
0.17%
6.8th percentile
In the Linux kernel, the following vulnerability has been resolved: rpmsg: char: Fix race between the release of rpmsg_ctrldev and cdev struct rpmsg_ctrldev contains a struct cdev. The current code frees the rpmsg_ctrldev struct in rpmsg_ctrldev_release_device(), but the cdev is a managed object, therefore its release is not predictable and the rpmsg_ctrldev could be freed before the cdev is entirely released, as in the backtrace below. [ 93.625603] ODEBUG: free active (active state 0) object type: timer_list hint: delayed_work_timer_fn+0x0/0x7c [ 93.636115] WARNING: CPU: 0 PID: 12 at lib/debugobjects.c:488 debug_print_object+0x13c/0x1b0 [ 93.644799] Modules linked in: veth xt_cgroup xt_MASQUERADE rfcomm algif_hash algif_skcipher af_alg uinput ip6table_nat fuse uvcvideo videobuf2_vmalloc venus_enc venus_dec videobuf2_dma_contig hci_uart btandroid btqca snd_soc_rt5682_i2c bluetooth qcom_spmi_temp_alarm snd_soc_rt5682v [ 93.715175] CPU: 0 PID: 12 Comm: kworker/0:1 Tainted: G B 5.4.163-lockdep #26 [ 93.723855] Hardware name: Google Lazor (rev3 - 8) with LTE (DT) [ 93.730055] Workqueue: events kobject_delayed_cleanup [ 93.735271] pstate: 60c00009 (nZCv daif +PAN +UAO) [ 93.740216] pc : debug_print_object+0x13c/0x1b0 [ 93.744890] lr : debug_print_object+0x13c/0x1b0 [ 93.749555] sp : ffffffacf5bc7940 [ 93.752978] x29: ffffffacf5bc7940 x28: dfffffd000000000 [ 93.758448] x27: ffffffacdb11a800 x26: dfffffd000000000 [ 93.763916] x25: ffffffd0734f856c x24: dfffffd000000000 [ 93.769389] x23: 0000000000000000 x22: ffffffd0733c35b0 [ 93.774860] x21: ffffffd0751994a0 x20: ffffffd075ec27c0 [ 93.780338] x19: ffffffd075199100 x18: 00000000000276e0 [ 93.785814] x17: 0000000000000000 x16: dfffffd000000000 [ 93.791291] x15: ffffffffffffffff x14: 6e6968207473696c [ 93.796768] x13: 0000000000000000 x12: ffffffd075e2b000 [ 93.802244] x11: 0000000000000001 x10: 0000000000000000 [ 93.807723] x9 : d13400dff1921900 x8 : d13400dff1921900 [ 93.813200] x7 : 0000000000000000 x6 : 00000000000000

Affected

20 ranges
VendorProductVersion rangeFixed in
debianlinux< linux 5.16.7-1 (bookworm)linux 5.16.7-1 (bookworm)
linuxlinux
linuxlinux>= c0cdc19f84a4712cf74888f83af286e3c2e14efd < 74d85e9fbc7022a4011102c7474a9c7aeb704a3574d85e9fbc7022a4011102c7474a9c7aeb704a35
linuxlinux>= c0cdc19f84a4712cf74888f83af286e3c2e14efd < 70cb4295ec806b663665e1d2ed15caab6159880e70cb4295ec806b663665e1d2ed15caab6159880e
linuxlinux>= c0cdc19f84a4712cf74888f83af286e3c2e14efd < da27b834c1e0222e149e06caddf7718478086d1bda27b834c1e0222e149e06caddf7718478086d1b
linuxlinux>= c0cdc19f84a4712cf74888f83af286e3c2e14efd < 1dbb206730f3e5ce90014ad569ddf8167ec4124a1dbb206730f3e5ce90014ad569ddf8167ec4124a
linuxlinux>= c0cdc19f84a4712cf74888f83af286e3c2e14efd < 85aba11a8ea92a8eef2de95ebbe063086fd62d9c85aba11a8ea92a8eef2de95ebbe063086fd62d9c
linuxlinux>= c0cdc19f84a4712cf74888f83af286e3c2e14efd < d6cdc6ae542845d4d0ac8b6d99362bde7042a3c7d6cdc6ae542845d4d0ac8b6d99362bde7042a3c7
linuxlinux>= c0cdc19f84a4712cf74888f83af286e3c2e14efd < b7fb2dad571d1e21173c06cef0bced77b323990ab7fb2dad571d1e21173c06cef0bced77b323990a
linuxlinux_kernel
linuxlinux_kernel>= 0 < 5.10.103-15.10.103-1
linuxlinux_kernel>= 0 < 5.16.7-15.16.7-1
linuxlinux_kernel>= 0 < 5.16.7-15.16.7-1
linuxlinux_kernel>= 0 < 5.16.7-15.16.7-1
linuxlinux_kernel>= 4.11 < 4.14.2654.14.265
linuxlinux_kernel>= 4.15 < 4.19.2284.19.228
linuxlinux_kernel>= 4.20 < 5.4.1765.4.176
linuxlinux_kernel>= 5.11 < 5.15.195.15.19
linuxlinux_kernel>= 5.16 < 5.16.55.16.5
linuxlinux_kernel>= 5.5 < 5.10.965.10.96

CVSS provenance

nvdv3.17.0HIGHCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
osv7.0HIGH
vendor_debian7.0HIGH
vendor_redhat7.0HIGH
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.