CVE-2022-48988
published 2024-10-21CVE-2022-48988: In the Linux kernel, the following vulnerability has been resolved: memcg: fix possible use-after-free in memcg_write_event_control()…
PriorityP335high7CVSS 3.1
AVLACHPRLUINSUCHIHAH
EPSS
0.24%
15.5th percentile
In the Linux kernel, the following vulnerability has been resolved:
memcg: fix possible use-after-free in memcg_write_event_control()
memcg_write_event_control() accesses the dentry->d_name of the specified
control fd to route the write call. As a cgroup interface file can't be
renamed, it's safe to access d_name as long as the specified file is a
regular cgroup file. Also, as these cgroup interface files can't be
removed before the directory, it's safe to access the parent too.
Prior to 347c4a874710 ("memcg: remove cgroup_event->cft"), there was a
call to __file_cft() which verified that the specified file is a regular
cgroupfs file before further accesses. The cftype pointer returned from
__file_cft() was no longer necessary and the commit inadvertently dropped
the file type check with it allowing any file to slip through. With the
invarients broken, the d_name and parent accesses can now race against
renames and removals of arbitrary files and cause use-after-free's.
Fix the bug by resurrecting the file type check in __file_cft(). Now that
cgroupfs is implemented through kernfs, checking the file operations needs
to go through a layer of indirection. Instead, let's check the superblock
and dentry type.
Affected
20 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 6.1.4-1 (bookworm) | linux 6.1.4-1 (bookworm) |
| linux | linux | — | — |
| linux | linux | >= 347c4a8747104a945ecced358944e42879176ca5 < b77600e26fd48727a95ffd50ba1e937efb548125 | b77600e26fd48727a95ffd50ba1e937efb548125 |
| linux | linux | >= 347c4a8747104a945ecced358944e42879176ca5 < e1ae97624ecf400ea56c238bff23e5cd139df0b8 | e1ae97624ecf400ea56c238bff23e5cd139df0b8 |
| linux | linux | >= 347c4a8747104a945ecced358944e42879176ca5 < 35963b31821920908e397146502066f6b032c917 | 35963b31821920908e397146502066f6b032c917 |
| linux | linux | >= 347c4a8747104a945ecced358944e42879176ca5 < f1f7f36cf682fa59db15e2089039a2eeb58ff2ad | f1f7f36cf682fa59db15e2089039a2eeb58ff2ad |
| linux | linux | >= 347c4a8747104a945ecced358944e42879176ca5 < aad8bbd17a1d586005feb9226c2e9cfce1432e13 | aad8bbd17a1d586005feb9226c2e9cfce1432e13 |
| linux | linux | >= 347c4a8747104a945ecced358944e42879176ca5 < 0ed074317b835caa6c03bcfa8f133365324673dc | 0ed074317b835caa6c03bcfa8f133365324673dc |
| linux | linux | >= 347c4a8747104a945ecced358944e42879176ca5 < 4a7ba45b1a435e7097ca0f79a847d0949d0eb088 | 4a7ba45b1a435e7097ca0f79a847d0949d0eb088 |
| linux | linux_kernel | — | — |
| linux | linux_kernel | >= 0 < 5.10.162-1 | 5.10.162-1 |
| linux | linux_kernel | >= 0 < 6.1.4-1 | 6.1.4-1 |
| linux | linux_kernel | >= 0 < 6.1.4-1 | 6.1.4-1 |
| linux | linux_kernel | >= 0 < 6.1.4-1 | 6.1.4-1 |
| linux | linux_kernel | >= 3.14 < 4.14.302 | 4.14.302 |
| linux | linux_kernel | >= 4.15 < 4.19.269 | 4.19.269 |
| linux | linux_kernel | >= 4.20 < 5.4.227 | 5.4.227 |
| linux | linux_kernel | >= 5.11 < 5.15.83 | 5.15.83 |
| linux | linux_kernel | >= 5.16 < 6.0.13 | 6.0.13 |
| linux | linux_kernel | >= 5.5 < 5.10.159 | 5.10.159 |
CVSS provenance
nvdv3.17.0HIGHCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
osv7.0HIGH
vendor_debian7.0HIGH
vendor_redhat7.0HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-9593-f5wq-r2vm: In the Linux kernel, the following vulnerability has been resolved:
memcg: fix possible use-after-free in memcg_write_event_control()
memcg_write_ev
ghsa_unreviewed·2024-10-21
CVE-2022-48988 [HIGH] CWE-416 GHSA-9593-f5wq-r2vm: In the Linux kernel, the following vulnerability has been resolved:
memcg: fix possible use-after-free in memcg_write_event_control()
memcg_write_ev
In the Linux kernel, the following vulnerability has been resolved:
memcg: fix possible use-after-free in memcg_write_event_control()
memcg_write_event_control() accesses the dentry->d_name of the specified
control fd to route the write call. As a cgroup interface file can't be
renamed, it's safe to access d_name as long as the specified file is a
regular cgroup file. Also, as these cgroup interface files can't be
removed before the directory, it's safe to access the parent too.
Prior to 347c4a874710 ("memcg: remove cgroup_event->cft"), there was a
call to __file_cft() which verified that the specified file is a regular
cgroupfs file before further accesses. The cftype pointer returned from
__file_cft() was no longer necessary and the commit inadvertently dropped
the file type check wit
OSV
CVE-2022-48988: In the Linux kernel, the following vulnerability has been resolved: memcg: fix possible use-after-free in memcg_write_event_control() memcg_write_even
osv·2024-10-21·CVSS 7.0
CVE-2022-48988 [HIGH] CVE-2022-48988: In the Linux kernel, the following vulnerability has been resolved: memcg: fix possible use-after-free in memcg_write_event_control() memcg_write_even
In the Linux kernel, the following vulnerability has been resolved: memcg: fix possible use-after-free in memcg_write_event_control() memcg_write_event_control() accesses the dentry->d_name of the specified control fd to route the write call. As a cgroup interface file can't be renamed, it's safe to access d_name as long as the specified file is a regular cgroup file. Also, as these cgroup interface files can't be removed before the directory, it's safe to access the parent too. Prior to 347c4a874710 ("memcg: remove cgroup_event->cft"), there was a call to __file_cft() which verified that the specified file is a regular cgroupfs file before further accesses. The cftype pointer returned from __file_cft() was no longer necessary and the commit inadvertently dropped the file type check with i
Red Hat
kernel: memcg: fix possible use-after-free in memcg_write_event_control()
vendor_redhat·2024-10-21·CVSS 7.0
CVE-2022-48988 [HIGH] CWE-416 kernel: memcg: fix possible use-after-free in memcg_write_event_control()
kernel: memcg: fix possible use-after-free in memcg_write_event_control()
In the Linux kernel, the following vulnerability has been resolved:
memcg: fix possible use-after-free in memcg_write_event_control()
memcg_write_event_control() accesses the dentry->d_name of the specified
control fd to route the write call. As a cgroup interface file can't be
renamed, it's safe to access d_name as long as the specified file is a
regular cgroup file. Also, as these cgroup interface files can't be
removed before the directory, it's safe to access the parent too.
Prior to 347c4a874710 ("memcg: remove cgroup_event->cft"), there was a
call to __file_cft() which verified that the specified file is a regular
cgroupfs file before further accesses. The cftype pointer returned from
__file_cft() was no longe
Debian
CVE-2022-48988: linux - In the Linux kernel, the following vulnerability has been resolved: memcg: fix ...
vendor_debian·2022·CVSS 7.0
CVE-2022-48988 [HIGH] CVE-2022-48988: linux - In the Linux kernel, the following vulnerability has been resolved: memcg: fix ...
In the Linux kernel, the following vulnerability has been resolved: memcg: fix possible use-after-free in memcg_write_event_control() memcg_write_event_control() accesses the dentry->d_name of the specified control fd to route the write call. As a cgroup interface file can't be renamed, it's safe to access d_name as long as the specified file is a regular cgroup file. Also, as these cgroup interface files can't be removed before the directory, it's safe to access the parent too. Prior to 347c4a874710 ("memcg: remove cgroup_event->cft"), there was a call to __file_cft() which verified that the specified file is a regular cgroupfs file before further accesses. The cftype pointer returned from __file_cft() was no longer necessary and the commit inadvertently dropped the file type check with i
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://git.kernel.org/stable/c/0ed074317b835caa6c03bcfa8f133365324673dchttps://git.kernel.org/stable/c/35963b31821920908e397146502066f6b032c917https://git.kernel.org/stable/c/4a7ba45b1a435e7097ca0f79a847d0949d0eb088https://git.kernel.org/stable/c/aad8bbd17a1d586005feb9226c2e9cfce1432e13https://git.kernel.org/stable/c/b77600e26fd48727a95ffd50ba1e937efb548125https://git.kernel.org/stable/c/e1ae97624ecf400ea56c238bff23e5cd139df0b8https://git.kernel.org/stable/c/f1f7f36cf682fa59db15e2089039a2eeb58ff2ad
2024-10-21
Published