CVE-2022-48821
published 2024-07-16CVE-2022-48821: In the Linux kernel, the following vulnerability has been resolved: misc: fastrpc: avoid double fput() on failed usercopy If the copy back to userland fails…
PriorityP339high7.8CVSS 3.1
AVLACLPRLUINSUCHIHAH
EPSS
0.27%
19.2th percentile
In the Linux kernel, the following vulnerability has been resolved:
misc: fastrpc: avoid double fput() on failed usercopy
If the copy back to userland fails for the FASTRPC_IOCTL_ALLOC_DMA_BUFF
ioctl(), we shouldn't assume that 'buf->dmabuf' is still valid. In fact,
dma_buf_fd() called fd_install() before, i.e. "consumed" one reference,
leaving us with none.
Calling dma_buf_put() will therefore put a reference we no longer own,
leading to a valid file descritor table entry for an already released
'file' object which is a straight use-after-free.
Simply avoid calling dma_buf_put() and rely on the process exit code to
do the necessary cleanup, if needed, i.e. if the file descriptor is
still valid.
Affected
16 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 5.16.10-1 (bookworm) | linux 5.16.10-1 (bookworm) |
| linux | linux | — | — |
| linux | linux | >= 6cffd79504ce040f460831030d3069fa1c99bb71 < 4e6fd2b5fcf8e7119305a6042bd92e7f2b9ed215 | 4e6fd2b5fcf8e7119305a6042bd92e7f2b9ed215 |
| linux | linux | >= 6cffd79504ce040f460831030d3069fa1c99bb71 < a5ce7ee5fcc07583159f54ab4af5164de00148f5 | a5ce7ee5fcc07583159f54ab4af5164de00148f5 |
| linux | linux | >= 6cffd79504ce040f460831030d3069fa1c99bb71 < e4382d0a39f9a1e260d62fdc079ddae5293c037d | e4382d0a39f9a1e260d62fdc079ddae5293c037d |
| linux | linux | >= 6cffd79504ce040f460831030d3069fa1c99bb71 < 76f85c307ef9f10aa2cef1b1d5ee654c1f3345fc | 76f85c307ef9f10aa2cef1b1d5ee654c1f3345fc |
| linux | linux | >= 6cffd79504ce040f460831030d3069fa1c99bb71 < 46963e2e0629cb31c96b1d47ddd89dc3d8990b34 | 46963e2e0629cb31c96b1d47ddd89dc3d8990b34 |
| linux | linux_kernel | — | — |
| linux | linux_kernel | >= 0 < 5.10.103-1 | 5.10.103-1 |
| linux | linux_kernel | >= 0 < 5.16.10-1 | 5.16.10-1 |
| linux | linux_kernel | >= 0 < 5.16.10-1 | 5.16.10-1 |
| linux | linux_kernel | >= 0 < 5.16.10-1 | 5.16.10-1 |
| linux | linux_kernel | >= 5.1 < 5.4.180 | 5.4.180 |
| linux | linux_kernel | >= 5.11 < 5.15.24 | 5.15.24 |
| linux | linux_kernel | >= 5.16 < 5.16.10 | 5.16.10 |
| linux | linux_kernel | >= 5.5 < 5.10.101 | 5.10.101 |
CVSS provenance
nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
osv7.8HIGH
vendor_debian7.8HIGH
vendor_redhat7.8HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
CVE-2022-48821: In the Linux kernel, the following vulnerability has been resolved: misc: fastrpc: avoid double fput() on failed usercopy If the copy back to userland
osv·2024-07-16·CVSS 7.8
CVE-2022-48821 [HIGH] CVE-2022-48821: In the Linux kernel, the following vulnerability has been resolved: misc: fastrpc: avoid double fput() on failed usercopy If the copy back to userland
In the Linux kernel, the following vulnerability has been resolved: misc: fastrpc: avoid double fput() on failed usercopy If the copy back to userland fails for the FASTRPC_IOCTL_ALLOC_DMA_BUFF ioctl(), we shouldn't assume that 'buf->dmabuf' is still valid. In fact, dma_buf_fd() called fd_install() before, i.e. "consumed" one reference, leaving us with none. Calling dma_buf_put() will therefore put a reference we no longer own, leading to a valid file descritor table entry for an already released 'file' object which is a straight use-after-free. Simply avoid calling dma_buf_put() and rely on the process exit code to do the necessary cleanup, if needed, i.e. if the file descriptor is still valid.
GHSA
GHSA-h4q9-9fhm-542g: In the Linux kernel, the following vulnerability has been resolved:
misc: fastrpc: avoid double fput() on failed usercopy
If the copy back to userla
ghsa_unreviewed·2024-07-16
CVE-2022-48821 [HIGH] CWE-416 GHSA-h4q9-9fhm-542g: In the Linux kernel, the following vulnerability has been resolved:
misc: fastrpc: avoid double fput() on failed usercopy
If the copy back to userla
In the Linux kernel, the following vulnerability has been resolved:
misc: fastrpc: avoid double fput() on failed usercopy
If the copy back to userland fails for the FASTRPC_IOCTL_ALLOC_DMA_BUFF
ioctl(), we shouldn't assume that 'buf->dmabuf' is still valid. In fact,
dma_buf_fd() called fd_install() before, i.e. "consumed" one reference,
leaving us with none.
Calling dma_buf_put() will therefore put a reference we no longer own,
leading to a valid file descritor table entry for an already released
'file' object which is a straight use-after-free.
Simply avoid calling dma_buf_put() and rely on the process exit code to
do the necessary cleanup, if needed, i.e. if the file descriptor is
still valid.
Red Hat
kernel: misc: fastrpc: avoid double fput() on failed usercopy
vendor_redhat·2024-07-16·CVSS 7.8
CVE-2022-48821 [HIGH] CWE-415 kernel: misc: fastrpc: avoid double fput() on failed usercopy
kernel: misc: fastrpc: avoid double fput() on failed usercopy
In the Linux kernel, the following vulnerability has been resolved:
misc: fastrpc: avoid double fput() on failed usercopy
If the copy back to userland fails for the FASTRPC_IOCTL_ALLOC_DMA_BUFF
ioctl(), we shouldn't assume that 'buf->dmabuf' is still valid. In fact,
dma_buf_fd() called fd_install() before, i.e. "consumed" one reference,
leaving us with none.
Calling dma_buf_put() will therefore put a reference we no longer own,
leading to a valid file descritor table entry for an already released
'file' object which is a straight use-after-free.
Simply avoid calling dma_buf_put() and rely on the process exit code to
do the necessary cleanup, if needed, i.e. if the file descriptor is
still valid.
Package: kernel (Red Hat Enterp
Debian
CVE-2022-48821: linux - In the Linux kernel, the following vulnerability has been resolved: misc: fastr...
vendor_debian·2022·CVSS 7.8
CVE-2022-48821 [HIGH] CVE-2022-48821: linux - In the Linux kernel, the following vulnerability has been resolved: misc: fastr...
In the Linux kernel, the following vulnerability has been resolved: misc: fastrpc: avoid double fput() on failed usercopy If the copy back to userland fails for the FASTRPC_IOCTL_ALLOC_DMA_BUFF ioctl(), we shouldn't assume that 'buf->dmabuf' is still valid. In fact, dma_buf_fd() called fd_install() before, i.e. "consumed" one reference, leaving us with none. Calling dma_buf_put() will therefore put a reference we no longer own, leading to a valid file descritor table entry for an already released 'file' object which is a straight use-after-free. Simply avoid calling dma_buf_put() and rely on the process exit code to do the necessary cleanup, if needed, i.e. if the file descriptor is still valid.
Scope: local
bookworm: resolved (fixed in 5.16.10-1)
bullseye: resolved (fixed in 5.10.103-1)
f
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://git.kernel.org/stable/c/46963e2e0629cb31c96b1d47ddd89dc3d8990b34https://git.kernel.org/stable/c/4e6fd2b5fcf8e7119305a6042bd92e7f2b9ed215https://git.kernel.org/stable/c/76f85c307ef9f10aa2cef1b1d5ee654c1f3345fchttps://git.kernel.org/stable/c/a5ce7ee5fcc07583159f54ab4af5164de00148f5https://git.kernel.org/stable/c/e4382d0a39f9a1e260d62fdc079ddae5293c037dhttps://git.kernel.org/stable/c/46963e2e0629cb31c96b1d47ddd89dc3d8990b34https://git.kernel.org/stable/c/4e6fd2b5fcf8e7119305a6042bd92e7f2b9ed215https://git.kernel.org/stable/c/76f85c307ef9f10aa2cef1b1d5ee654c1f3345fchttps://git.kernel.org/stable/c/a5ce7ee5fcc07583159f54ab4af5164de00148f5https://git.kernel.org/stable/c/e4382d0a39f9a1e260d62fdc079ddae5293c037d
2024-07-16
Published