CVE-2022-48899
published 2024-08-21CVE-2022-48899: In the Linux kernel, the following vulnerability has been resolved: drm/virtio: Fix GEM handle creation UAF Userspace can guess the handle value and try to…
PriorityP415medium4.7CVSS 3.1
AVLACHPRLUINSUCNINAH
EPSS
0.24%
15.9th percentile
In the Linux kernel, the following vulnerability has been resolved:
drm/virtio: Fix GEM handle creation UAF
Userspace can guess the handle value and try to race GEM object creation
with handle close, resulting in a use-after-free if we dereference the
object after dropping the handle's reference. For that reason, dropping
the handle's reference must be done *after* we are done dereferencing
the object.
Affected
20 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 6.1.7-1 (bookworm) | linux 6.1.7-1 (bookworm) |
| linux | linux | — | — |
| linux | linux | >= 62fb7a5e10962ac6ae2a2d2dbd3aedcb2a3e3257 < 19ec87d06acfab2313ee82b2a689bf0c154e57ea | 19ec87d06acfab2313ee82b2a689bf0c154e57ea |
| linux | linux | >= 62fb7a5e10962ac6ae2a2d2dbd3aedcb2a3e3257 < d01d6d2b06c0d8390adf8f3ba08aa60b5642ef73 | d01d6d2b06c0d8390adf8f3ba08aa60b5642ef73 |
| linux | linux | >= 62fb7a5e10962ac6ae2a2d2dbd3aedcb2a3e3257 < 68bcd063857075d2f9edfed6024387ac377923e2 | 68bcd063857075d2f9edfed6024387ac377923e2 |
| linux | linux | >= 62fb7a5e10962ac6ae2a2d2dbd3aedcb2a3e3257 < 011ecdbcd520c90c344b872ca6b4821f7783b2f8 | 011ecdbcd520c90c344b872ca6b4821f7783b2f8 |
| linux | linux | >= 62fb7a5e10962ac6ae2a2d2dbd3aedcb2a3e3257 < adc48e5e408afbb01d261bd303fd9fbbbaa3e317 | adc48e5e408afbb01d261bd303fd9fbbbaa3e317 |
| linux | linux | >= 62fb7a5e10962ac6ae2a2d2dbd3aedcb2a3e3257 < 52531258318ed59a2dc5a43df2eaf0eb1d65438e | 52531258318ed59a2dc5a43df2eaf0eb1d65438e |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | >= 0 < 5.10.178-1 | 5.10.178-1 |
| linux | linux_kernel | >= 0 < 6.1.7-1 | 6.1.7-1 |
| linux | linux_kernel | >= 0 < 6.1.7-1 | 6.1.7-1 |
| linux | linux_kernel | >= 0 < 6.1.7-1 | 6.1.7-1 |
| linux | linux_kernel | >= 4.20 < 5.4.229 | 5.4.229 |
| linux | linux_kernel | >= 4.4 < 4.19.270 | 4.19.270 |
| linux | linux_kernel | >= 5.11 < 5.15.89 | 5.15.89 |
| linux | linux_kernel | >= 5.16 < 6.1.7 | 6.1.7 |
| linux | linux_kernel | >= 5.5 < 5.10.164 | 5.10.164 |
CVSS provenance
nvdv3.14.7MEDIUMCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
osv4.7MEDIUM
vendor_debian4.7MEDIUM
vendor_redhat4.7MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
kernel: drm/virtio: Fix GEM handle creation UAF
vendor_redhat·2024-08-21·CVSS 4.7
CVE-2022-48899 [MEDIUM] CWE-416 kernel: drm/virtio: Fix GEM handle creation UAF
kernel: drm/virtio: Fix GEM handle creation UAF
In the Linux kernel, the following vulnerability has been resolved:
drm/virtio: Fix GEM handle creation UAF
Userspace can guess the handle value and try to race GEM object creation
with handle close, resulting in a use-after-free if we dereference the
object after dropping the handle's reference. For that reason, dropping
the handle's reference must be done *after* we are done dereferencing
the object.
A flaw was found in the Linux kernel's GPU driver support functionality in which a attacker could trigger a race condition, leading to a use-after-free and consequent denial of service.
Package: kernel (Red Hat Enterprise Linux 6) - Not affected
Package: kernel (Red Hat Enterprise Linux 7) - Out of support scope
Package: kernel-rt (Red Hat
Debian
CVE-2022-48899: linux - In the Linux kernel, the following vulnerability has been resolved: drm/virtio:...
vendor_debian·2022·CVSS 4.7
CVE-2022-48899 [MEDIUM] CVE-2022-48899: linux - In the Linux kernel, the following vulnerability has been resolved: drm/virtio:...
In the Linux kernel, the following vulnerability has been resolved: drm/virtio: Fix GEM handle creation UAF Userspace can guess the handle value and try to race GEM object creation with handle close, resulting in a use-after-free if we dereference the object after dropping the handle's reference. For that reason, dropping the handle's reference must be done *after* we are done dereferencing the object.
Scope: local
bookworm: resolved (fixed in 6.1.7-1)
bullseye: resolved (fixed in 5.10.178-1)
forky: resolved (fixed in 6.1.7-1)
sid: resolved (fixed in 6.1.7-1)
trixie: resolved (fixed in 6.1.7-1)
GHSA
GHSA-wg5x-3j3h-vr62: In the Linux kernel, the following vulnerability has been resolved:
drm/virtio: Fix GEM handle creation UAF
Userspace can guess the handle value and
ghsa_unreviewed·2024-08-21
CVE-2022-48899 [MEDIUM] CWE-416 GHSA-wg5x-3j3h-vr62: In the Linux kernel, the following vulnerability has been resolved:
drm/virtio: Fix GEM handle creation UAF
Userspace can guess the handle value and
In the Linux kernel, the following vulnerability has been resolved:
drm/virtio: Fix GEM handle creation UAF
Userspace can guess the handle value and try to race GEM object creation
with handle close, resulting in a use-after-free if we dereference the
object after dropping the handle's reference. For that reason, dropping
the handle's reference must be done *after* we are done dereferencing
the object.
OSV
CVE-2022-48899: In the Linux kernel, the following vulnerability has been resolved: drm/virtio: Fix GEM handle creation UAF Userspace can guess the handle value and t
osv·2024-08-21·CVSS 4.7
CVE-2022-48899 [MEDIUM] CVE-2022-48899: In the Linux kernel, the following vulnerability has been resolved: drm/virtio: Fix GEM handle creation UAF Userspace can guess the handle value and t
In the Linux kernel, the following vulnerability has been resolved: drm/virtio: Fix GEM handle creation UAF Userspace can guess the handle value and try to race GEM object creation with handle close, resulting in a use-after-free if we dereference the object after dropping the handle's reference. For that reason, dropping the handle's reference must be done *after* we are done dereferencing the object.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://git.kernel.org/stable/c/011ecdbcd520c90c344b872ca6b4821f7783b2f8https://git.kernel.org/stable/c/19ec87d06acfab2313ee82b2a689bf0c154e57eahttps://git.kernel.org/stable/c/52531258318ed59a2dc5a43df2eaf0eb1d65438ehttps://git.kernel.org/stable/c/68bcd063857075d2f9edfed6024387ac377923e2https://git.kernel.org/stable/c/adc48e5e408afbb01d261bd303fd9fbbbaa3e317https://git.kernel.org/stable/c/d01d6d2b06c0d8390adf8f3ba08aa60b5642ef73
2024-08-21
Published