cbcvebase.
CVE-2022-49085
published 2025-02-26

CVE-2022-49085: In the Linux kernel, the following vulnerability has been resolved: drbd: Fix five use after free bugs in get_initial_state In get_initial_state, it calls…

PriorityP338high7.8CVSS 3.1
AVLACLPRLUINSUCHIHAH
EPSS
0.28%
20.2th percentile
In the Linux kernel, the following vulnerability has been resolved: drbd: Fix five use after free bugs in get_initial_state In get_initial_state, it calls notify_initial_state_done(skb,..) if cb->args[5]==1. If genlmsg_put() failed in notify_initial_state_done(), the skb will be freed by nlmsg_free(skb). Then get_initial_state will goto out and the freed skb will be used by return value skb->len, which is a uaf bug. What's worse, the same problem goes even further: skb can also be freed in the notify_*_state_change -> notify_*_state calls below. Thus 4 additional uaf bugs happened. My patch lets the problem callee functions: notify_initial_state_done and notify_*_state_change return an error code if errors happen. So that the error codes could be propagated and the uaf bugs can be avoid. v2 reports a compilation warning. This v3 fixed this warning and built successfully in my local environment with no additional warnings. v2: https://lore.kernel.org/patchwork/patch/1435218/

Affected

24 ranges
VendorProductVersion rangeFixed in
debianlinux< linux 5.17.3-1 (bookworm)linux 5.17.3-1 (bookworm)
linuxlinux——
linuxlinux>= a29728463b254ce81ecefdf20c1a02e01d9361da < 0489700bfeb1e53eb2039c2291c67e71b0b401030489700bfeb1e53eb2039c2291c67e71b0b40103
linuxlinux>= a29728463b254ce81ecefdf20c1a02e01d9361da < dcf6be17b5c53b741898d2223b23e66d682de300dcf6be17b5c53b741898d2223b23e66d682de300
linuxlinux>= a29728463b254ce81ecefdf20c1a02e01d9361da < 188fe6b26765edbad4055611c0f788b6870f4024188fe6b26765edbad4055611c0f788b6870f4024
linuxlinux>= a29728463b254ce81ecefdf20c1a02e01d9361da < b6a4055036eed1f5e239ce3d8b0db1ce38bba447b6a4055036eed1f5e239ce3d8b0db1ce38bba447
linuxlinux>= a29728463b254ce81ecefdf20c1a02e01d9361da < 594205b4936771a250f9d141e7e0fff21c3dd2d9594205b4936771a250f9d141e7e0fff21c3dd2d9
linuxlinux>= a29728463b254ce81ecefdf20c1a02e01d9361da < a972c768723359ec995579902473028fe3cd64b1a972c768723359ec995579902473028fe3cd64b1
linuxlinux>= a29728463b254ce81ecefdf20c1a02e01d9361da < de63e74da2333b4068bb79983e632db730fea97ede63e74da2333b4068bb79983e632db730fea97e
linuxlinux>= a29728463b254ce81ecefdf20c1a02e01d9361da < 226e993c39405292781bfcf4b039a8db56aab362226e993c39405292781bfcf4b039a8db56aab362
linuxlinux>= a29728463b254ce81ecefdf20c1a02e01d9361da < aadb22ba2f656581b2f733deb3a467c48cc618f6aadb22ba2f656581b2f733deb3a467c48cc618f6
linuxlinux_kernel——
linuxlinux_kernel>= 0 < 5.10.113-15.10.113-1
linuxlinux_kernel>= 0 < 5.17.3-15.17.3-1
linuxlinux_kernel>= 0 < 5.17.3-15.17.3-1
linuxlinux_kernel>= 0 < 5.17.3-15.17.3-1
linuxlinux_kernel>= 4.10 < 4.14.2764.14.276
linuxlinux_kernel>= 4.15 < 4.19.2384.19.238
linuxlinux_kernel>= 4.20 < 5.4.1895.4.189
linuxlinux_kernel>= 4.5 < 4.9.3114.9.311
linuxlinux_kernel>= 5.11 < 5.15.345.15.34
linuxlinux_kernel>= 5.16 < 5.16.205.16.20
linuxlinux_kernel>= 5.17 < 5.17.35.17.3
linuxlinux_kernel>= 5.5 < 5.10.1115.10.111

CVSS provenance

nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
osv7.8HIGH
vendor_debian7.8HIGH
vendor_redhat7.8HIGH
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.