cbcvebase.
CVE-2022-49892
published 2025-05-01

CVE-2022-49892: In the Linux kernel, the following vulnerability has been resolved: ftrace: Fix use-after-free for dynamic ftrace_ops KASAN reported a use-after-free with…

PriorityP338high7.8CVSS 3.1
AVLACLPRLUINSUCHIHAH
EPSS
0.19%
9.4th percentile
In the Linux kernel, the following vulnerability has been resolved: ftrace: Fix use-after-free for dynamic ftrace_ops KASAN reported a use-after-free with ftrace ops [1]. It was found from vmcore that perf had registered two ops with the same content successively, both dynamic. After unregistering the second ops, a use-after-free occurred. In ftrace_shutdown(), when the second ops is unregistered, the FTRACE_UPDATE_CALLS command is not set because there is another enabled ops with the same content. Also, both ops are dynamic and the ftrace callback function is ftrace_ops_list_func, so the FTRACE_UPDATE_TRACE_FUNC command will not be set. Eventually the value of 'command' will be 0 and ftrace_shutdown() will skip the rcu synchronization. However, ftrace may be activated. When the ops is released, another CPU may be accessing the ops. Add the missing synchronization to fix this problem. [1] BUG: KASAN: use-after-free in __ftrace_ops_list_func kernel/trace/ftrace.c:7020 [inline] BUG: KASAN: use-after-free in ftrace_ops_list_func+0x2b0/0x31c kernel/trace/ftrace.c:7049 Read of size 8 at addr ffff56551965bbc8 by task syz-executor.2/14468 CPU: 1 PID: 14468 Comm: syz-executor.2 Not tainted 5.10.0 #7 Hardware name: linux,dummy-virt (DT) Call trace: dump_backtrace+0x0/0x40c arch/arm64/kernel/stacktrace.c:132 show_stack+0x30/0x40 arch/arm64/kernel/stacktrace.c:196 __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x1b4/0x248 lib/dump_stack.c:118 print_address_description.constprop.0+0x28/0x48c mm/kasan/report.c:387 __kasan_report mm/kasan/report.c:547 [inline] kasan_report+0x118/0x210 mm/kasan/report.c:564 check_memory_region_inline mm/kasan/generic.c:187 [inline] __asan_load8+0x98/0xc0 mm/kasan/generic.c:253 __ftrace_ops_list_func kernel/trace/ftrace.c:7020 [inline] ftrace_ops_list_func+0x2b0/0x31c kernel/trace/ftrace.c:7049 ftrace_graph_call+0x0/0x4 __might_sleep+0x8/0x100 include/linux/perf_event.h:1170 __might_fault mm/memory.c:5183 [inline] __might_fault+0x58/0x7

Affected

25 ranges
VendorProductVersion rangeFixed in
debianlinux< linux 6.0.8-1 (bookworm)linux 6.0.8-1 (bookworm)
linuxlinux——
linuxlinux——
linuxlinux——
linuxlinux——
linuxlinux——
linuxlinux>= 4.1.45 < 4.24.2
linuxlinux>= 4.13.4 < 4.144.14
linuxlinux>= 4.4.89 < 4.54.5
linuxlinux>= 4.9.52 < 4.104.10
linuxlinux>= edb096e00724f02db5f6ec7900f3bbd465c6c76f < ea5f2fd4640ecbb9df969bf8bb27733ae2183169ea5f2fd4640ecbb9df969bf8bb27733ae2183169
linuxlinux>= edb096e00724f02db5f6ec7900f3bbd465c6c76f < 88561a66777e7a2fe06638c6dcb22a9fae0b673388561a66777e7a2fe06638c6dcb22a9fae0b6733
linuxlinux>= edb096e00724f02db5f6ec7900f3bbd465c6c76f < cc1b9961a0ceb70f6ca4e2f4b8bb71c87c7a495ccc1b9961a0ceb70f6ca4e2f4b8bb71c87c7a495c
linuxlinux>= edb096e00724f02db5f6ec7900f3bbd465c6c76f < 0e792b89e6800cd9cb4757a76a96f7ef3e8b62940e792b89e6800cd9cb4757a76a96f7ef3e8b6294
linuxlinux_kernel——
linuxlinux_kernel>= 0 < 5.10.158-15.10.158-1
linuxlinux_kernel>= 0 < 6.0.8-16.0.8-1
linuxlinux_kernel>= 0 < 6.0.8-16.0.8-1
linuxlinux_kernel>= 0 < 6.0.8-16.0.8-1
linuxlinux_kernel>= 4.1.45 < 4.24.2
linuxlinux_kernel>= 4.13.4 < 5.10.1545.10.154
linuxlinux_kernel>= 4.4.89 < 4.54.5
linuxlinux_kernel>= 4.9.52 < 4.104.10
linuxlinux_kernel>= 5.11 < 5.15.785.15.78
linuxlinux_kernel>= 5.16 < 6.0.86.0.8

CVSS provenance

nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
osv7.8HIGH
vendor_debian7.8HIGH
vendor_redhat7.8HIGH
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.