CVE-2022-48771
published 2024-06-20CVE-2022-48771: In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: Fix stale file descriptors on failed usercopy A failing usercopy of the…
PriorityP338high7.8CVSS 3.1
AVLACLPRLUINSUCHIHAH
EPSS
0.21%
11.7th percentile
In the Linux kernel, the following vulnerability has been resolved:
drm/vmwgfx: Fix stale file descriptors on failed usercopy
A failing usercopy of the fence_rep object will lead to a stale entry in
the file descriptor table as put_unused_fd() won't release it. This
enables userland to refer to a dangling 'file' object through that still
valid file descriptor, leading to all kinds of use-after-free
exploitation scenarios.
Fix this by deferring the call to fd_install() until after the usercopy
has succeeded.
Affected
24 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 5.16.7-1 (bookworm) | linux 5.16.7-1 (bookworm) |
| google-protobuf | >= 0 < 3.16.3 | 3.16.3 | |
| google-protobuf | >= 3.17.0.rc.1 < 3.19.6 | 3.19.6 | |
| google-protobuf | >= 3.20.0.rc.1 < 3.20.3 | 3.20.3 | |
| google-protobuf | >= 3.21.0.rc.1 < 3.21.7 | 3.21.7 | |
| linux | linux | — | — |
| linux | linux | >= c906965dee22d5e95d0651759ba107b420212a9f < e8d092a62449dcfc73517ca43963d2b8f44d0516 | e8d092a62449dcfc73517ca43963d2b8f44d0516 |
| linux | linux | >= c906965dee22d5e95d0651759ba107b420212a9f < 0008a0c78fc33a84e2212a7c04e6b21a36ca6f4d | 0008a0c78fc33a84e2212a7c04e6b21a36ca6f4d |
| linux | linux | >= c906965dee22d5e95d0651759ba107b420212a9f < 84b1259fe36ae0915f3d6ddcea6377779de48b82 | 84b1259fe36ae0915f3d6ddcea6377779de48b82 |
| linux | linux | >= c906965dee22d5e95d0651759ba107b420212a9f < ae2b20f27732fe92055d9e7b350abc5cdf3e2414 | ae2b20f27732fe92055d9e7b350abc5cdf3e2414 |
| linux | linux | >= c906965dee22d5e95d0651759ba107b420212a9f < 6066977961fc6f437bc064f628cf9b0e4571c56c | 6066977961fc6f437bc064f628cf9b0e4571c56c |
| linux | linux | >= c906965dee22d5e95d0651759ba107b420212a9f < 1d833b27fb708d6fdf5de9f6b3a8be4bd4321565 | 1d833b27fb708d6fdf5de9f6b3a8be4bd4321565 |
| linux | linux | >= c906965dee22d5e95d0651759ba107b420212a9f < a0f90c8815706981c483a652a6aefca51a5e191c | a0f90c8815706981c483a652a6aefca51a5e191c |
| linux | linux_kernel | — | — |
| linux | linux_kernel | >= 0 < 5.10.103-1 | 5.10.103-1 |
| linux | linux_kernel | >= 0 < 5.16.7-1 | 5.16.7-1 |
| linux | linux_kernel | >= 0 < 5.16.7-1 | 5.16.7-1 |
| linux | linux_kernel | >= 0 < 5.16.7-1 | 5.16.7-1 |
| linux | linux_kernel | >= 4.14 < 4.14.264 | 4.14.264 |
| linux | linux_kernel | >= 4.15 < 4.19.227 | 4.19.227 |
| linux | linux_kernel | >= 4.20 < 5.4.175 | 5.4.175 |
| linux | linux_kernel | >= 5.11 < 5.15.18 | 5.15.18 |
| linux | linux_kernel | >= 5.16 < 5.16.4 | 5.16.4 |
| linux | linux_kernel | >= 5.5 < 5.10.95 | 5.10.95 |
CVSS provenance
nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
ghsa7.5HIGH
osv7.8HIGH
vendor_debian7.8HIGH
vendor_redhat7.8HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
kernel: drm/vmwgfx: Fix stale file descriptors on failed usercopy
vendor_redhat·2024-06-20·CVSS 7.8
CVE-2022-48771 [HIGH] CWE-416 kernel: drm/vmwgfx: Fix stale file descriptors on failed usercopy
kernel: drm/vmwgfx: Fix stale file descriptors on failed usercopy
In the Linux kernel, the following vulnerability has been resolved:
drm/vmwgfx: Fix stale file descriptors on failed usercopy
A failing usercopy of the fence_rep object will lead to a stale entry in
the file descriptor table as put_unused_fd() won't release it. This
enables userland to refer to a dangling 'file' object through that still
valid file descriptor, leading to all kinds of use-after-free
exploitation scenarios.
Fix this by deferring the call to fd_install() until after the usercopy
has succeeded.
A use-after-free vulnerability has been identified in the Linux kernel's VMware graphics driver (vmwgfx) driver. This flaw occurs during the usercopy operation for the fence_rep object. If this operation fails, it can l
Debian
CVE-2022-48771: linux - In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx:...
vendor_debian·2022·CVSS 7.8
CVE-2022-48771 [HIGH] CVE-2022-48771: linux - In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx:...
In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: Fix stale file descriptors on failed usercopy A failing usercopy of the fence_rep object will lead to a stale entry in the file descriptor table as put_unused_fd() won't release it. This enables userland to refer to a dangling 'file' object through that still valid file descriptor, leading to all kinds of use-after-free exploitation scenarios. Fix this by deferring the call to fd_install() until after the usercopy has succeeded.
Scope: local
bookworm: resolved (fixed in 5.16.7-1)
bullseye: resolved (fixed in 5.10.103-1)
forky: resolved (fixed in 5.16.7-1)
sid: resolved (fixed in 5.16.7-1)
trixie: resolved (fixed in 5.16.7-1)
OSV
CVE-2022-48771: In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: Fix stale file descriptors on failed usercopy A failing usercopy of th
osv·2024-06-20·CVSS 7.8
CVE-2022-48771 [HIGH] CVE-2022-48771: In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: Fix stale file descriptors on failed usercopy A failing usercopy of th
In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: Fix stale file descriptors on failed usercopy A failing usercopy of the fence_rep object will lead to a stale entry in the file descriptor table as put_unused_fd() won't release it. This enables userland to refer to a dangling 'file' object through that still valid file descriptor, leading to all kinds of use-after-free exploitation scenarios. Fix this by deferring the call to fd_install() until after the usercopy has succeeded.
GHSA
GHSA-j2qm-vfcf-p3gj: In the Linux kernel, the following vulnerability has been resolved:
drm/vmwgfx: Fix stale file descriptors on failed usercopy
A failing usercopy of
ghsa_unreviewed·2024-06-20
CVE-2022-48771 [HIGH] CWE-416 GHSA-j2qm-vfcf-p3gj: In the Linux kernel, the following vulnerability has been resolved:
drm/vmwgfx: Fix stale file descriptors on failed usercopy
A failing usercopy of
In the Linux kernel, the following vulnerability has been resolved:
drm/vmwgfx: Fix stale file descriptors on failed usercopy
A failing usercopy of the fence_rep object will lead to a stale entry in
the file descriptor table as put_unused_fd() won't release it. This
enables userland to refer to a dangling 'file' object through that still
valid file descriptor, leading to all kinds of use-after-free
exploitation scenarios.
Fix this by deferring the call to fd_install() until after the usercopy
has succeeded.
GHSA
protobuf-java has a potential Denial of Service issue
ghsa·2022-10-04·CVSS 7.5
CVE-2022-3171 [MEDIUM] CWE-20 protobuf-java has a potential Denial of Service issue
protobuf-java has a potential Denial of Service issue
## Summary
A potential Denial of Service issue in `protobuf-java` core and lite was discovered in the parsing procedure for binary and text format data. Input streams containing multiple instances of non-repeated [embedded messages](http://developers.google.com/protocol-buffers/docs/encoding#embedded) with repeated or unknown fields causes objects to be converted back-n-forth between mutable and immutable forms, resulting in potentially long garbage collection pauses.
Reporter: [OSS Fuzz](https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=48771)
Affected versions: This issue affects both the Java full and lite Protobuf runtimes, as well as Protobuf for Kotlin and JRuby, which themselves use the Java Protobuf runtime.
## Severity
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://git.kernel.org/stable/c/0008a0c78fc33a84e2212a7c04e6b21a36ca6f4dhttps://git.kernel.org/stable/c/1d833b27fb708d6fdf5de9f6b3a8be4bd4321565https://git.kernel.org/stable/c/6066977961fc6f437bc064f628cf9b0e4571c56chttps://git.kernel.org/stable/c/84b1259fe36ae0915f3d6ddcea6377779de48b82https://git.kernel.org/stable/c/a0f90c8815706981c483a652a6aefca51a5e191chttps://git.kernel.org/stable/c/ae2b20f27732fe92055d9e7b350abc5cdf3e2414https://git.kernel.org/stable/c/e8d092a62449dcfc73517ca43963d2b8f44d0516https://git.kernel.org/stable/c/0008a0c78fc33a84e2212a7c04e6b21a36ca6f4dhttps://git.kernel.org/stable/c/1d833b27fb708d6fdf5de9f6b3a8be4bd4321565https://git.kernel.org/stable/c/6066977961fc6f437bc064f628cf9b0e4571c56chttps://git.kernel.org/stable/c/84b1259fe36ae0915f3d6ddcea6377779de48b82https://git.kernel.org/stable/c/a0f90c8815706981c483a652a6aefca51a5e191chttps://git.kernel.org/stable/c/ae2b20f27732fe92055d9e7b350abc5cdf3e2414https://git.kernel.org/stable/c/e8d092a62449dcfc73517ca43963d2b8f44d0516
2024-06-20
Published