CVE-2022-49770
published 2025-05-01CVE-2022-49770: In the Linux kernel, the following vulnerability has been resolved: ceph: avoid putting the realm twice when decoding snaps fails When decoding the snaps fails…
PriorityP337high7.8CVSS 3.1
AVLACLPRLUINSUCHIHAH
EPSS
0.21%
11.6th percentile
In the Linux kernel, the following vulnerability has been resolved:
ceph: avoid putting the realm twice when decoding snaps fails
When decoding the snaps fails it maybe leaving the 'first_realm'
and 'realm' pointing to the same snaprealm memory. And then it'll
put it twice and could cause random use-after-free, BUG_ON, etc
issues.
Affected
19 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 6.0.10-1 (bookworm) | linux 6.0.10-1 (bookworm) |
| linux | linux | — | — |
| linux | linux | >= 9030aaf9bf0a1eee47a154c316c789e959638b0f < 274e4c79a3a2a24fba7cfe0e41113f1138785c37 | 274e4c79a3a2a24fba7cfe0e41113f1138785c37 |
| linux | linux | >= 9030aaf9bf0a1eee47a154c316c789e959638b0f < cb7495fe957526555782ce0723f79ce92a6db22e | cb7495fe957526555782ce0723f79ce92a6db22e |
| linux | linux | >= 9030aaf9bf0a1eee47a154c316c789e959638b0f < 044bc6d3c2c0e9090b0841e7b723875756534b45 | 044bc6d3c2c0e9090b0841e7b723875756534b45 |
| linux | linux | >= 9030aaf9bf0a1eee47a154c316c789e959638b0f < 2f6e2de3a5289004650118b61f138fe7c28e1905 | 2f6e2de3a5289004650118b61f138fe7c28e1905 |
| linux | linux | >= 9030aaf9bf0a1eee47a154c316c789e959638b0f < fd879c83e87735ab8f00ef7755752cf0cbae24b2 | fd879c83e87735ab8f00ef7755752cf0cbae24b2 |
| linux | linux | >= 9030aaf9bf0a1eee47a154c316c789e959638b0f < 51884d153f7ec85e18d607b2467820a90e0f4359 | 51884d153f7ec85e18d607b2467820a90e0f4359 |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | >= 0 < 5.10.158-1 | 5.10.158-1 |
| linux | linux_kernel | >= 0 < 6.0.10-1 | 6.0.10-1 |
| linux | linux_kernel | >= 0 < 6.0.10-1 | 6.0.10-1 |
| linux | linux_kernel | >= 0 < 6.0.10-1 | 6.0.10-1 |
| linux | linux_kernel | >= 2.6.35 < 4.19.268 | 4.19.268 |
| linux | linux_kernel | >= 4.20 < 5.4.226 | 5.4.226 |
| linux | linux_kernel | >= 5.11 < 5.15.81 | 5.15.81 |
| linux | linux_kernel | >= 5.16 < 6.0.10 | 6.0.10 |
| linux | linux_kernel | >= 5.5 < 5.10.157 | 5.10.157 |
CVSS provenance
nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
osv7.8HIGH
vendor_debian7.8HIGH
vendor_redhat7.8HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
kernel: ceph: avoid putting the realm twice when decoding snaps fails
vendor_redhat·2025-05-01·CVSS 7.8
CVE-2022-49770 [HIGH] CWE-416 kernel: ceph: avoid putting the realm twice when decoding snaps fails
kernel: ceph: avoid putting the realm twice when decoding snaps fails
In the Linux kernel, the following vulnerability has been resolved:
ceph: avoid putting the realm twice when decoding snaps fails
When decoding the snaps fails it maybe leaving the 'first_realm'
and 'realm' pointing to the same snaprealm memory. And then it'll
put it twice and could cause random use-after-free, BUG_ON, etc
issues.
Statement: A logic error in ceph_update_snap_trace() may lead to a use-after-free condition when decoding snapshots, if first_realm and realm point to the same object and are released twice.
This may result in kernel memory corruption or a crash via BUG_ON, and is potentially exploitable for privilege escalation or information disclosure.
The vulnerability is exploitable by local users with a
Debian
CVE-2022-49770: linux - In the Linux kernel, the following vulnerability has been resolved: ceph: avoid...
vendor_debian·2022·CVSS 7.8
CVE-2022-49770 [HIGH] CVE-2022-49770: linux - In the Linux kernel, the following vulnerability has been resolved: ceph: avoid...
In the Linux kernel, the following vulnerability has been resolved: ceph: avoid putting the realm twice when decoding snaps fails When decoding the snaps fails it maybe leaving the 'first_realm' and 'realm' pointing to the same snaprealm memory. And then it'll put it twice and could cause random use-after-free, BUG_ON, etc issues.
Scope: local
bookworm: resolved (fixed in 6.0.10-1)
bullseye: resolved (fixed in 5.10.158-1)
forky: resolved (fixed in 6.0.10-1)
sid: resolved (fixed in 6.0.10-1)
trixie: resolved (fixed in 6.0.10-1)
GHSA
GHSA-vc2j-428r-9px5: In the Linux kernel, the following vulnerability has been resolved:
ceph: avoid putting the realm twice when decoding snaps fails
When decoding the
ghsa_unreviewed·2025-05-01
CVE-2022-49770 [HIGH] CWE-416 GHSA-vc2j-428r-9px5: In the Linux kernel, the following vulnerability has been resolved:
ceph: avoid putting the realm twice when decoding snaps fails
When decoding the
In the Linux kernel, the following vulnerability has been resolved:
ceph: avoid putting the realm twice when decoding snaps fails
When decoding the snaps fails it maybe leaving the 'first_realm'
and 'realm' pointing to the same snaprealm memory. And then it'll
put it twice and could cause random use-after-free, BUG_ON, etc
issues.
OSV
CVE-2022-49770: In the Linux kernel, the following vulnerability has been resolved: ceph: avoid putting the realm twice when decoding snaps fails When decoding the sn
osv·2025-05-01·CVSS 7.8
CVE-2022-49770 [HIGH] CVE-2022-49770: In the Linux kernel, the following vulnerability has been resolved: ceph: avoid putting the realm twice when decoding snaps fails When decoding the sn
In the Linux kernel, the following vulnerability has been resolved: ceph: avoid putting the realm twice when decoding snaps fails When decoding the snaps fails it maybe leaving the 'first_realm' and 'realm' pointing to the same snaprealm memory. And then it'll put it twice and could cause random use-after-free, BUG_ON, etc issues.
No detection rules found.
No public exploits indexed.
https://git.kernel.org/stable/c/044bc6d3c2c0e9090b0841e7b723875756534b45https://git.kernel.org/stable/c/274e4c79a3a2a24fba7cfe0e41113f1138785c37https://git.kernel.org/stable/c/2f6e2de3a5289004650118b61f138fe7c28e1905https://git.kernel.org/stable/c/51884d153f7ec85e18d607b2467820a90e0f4359https://git.kernel.org/stable/c/cb7495fe957526555782ce0723f79ce92a6db22ehttps://git.kernel.org/stable/c/fd879c83e87735ab8f00ef7755752cf0cbae24b2
2025-05-01
Published