Skip to content
CVE PROGRAM SOURCE RECORD7.8 High

CVE-2022-48872

misc: fastrpc: Fix use-after-free race condition for maps

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Linux

Description

In the Linux kernel, the following vulnerability has been resolved: misc: fastrpc: Fix use-after-free race condition for maps It is possible that in between calling fastrpc_map_get() until map->fl->lock is taken in fastrpc_free_map(), another thread can call fastrpc_map_lookup() and get a reference to a map that is about to be deleted. Rewrite fastrpc_map_get() to only increase the reference count of a map if it's non-zero. Propagate this to callers so they can know if a map is about to be deleted. Fixes this warning: refcount_t: addition on 0; use-after-free. WARNING: CPU: 5 PID: 10100 at lib/refcount.c:25 refcount_warn_saturate ... Call trace: refcount_warn_saturate [fastrpc_map_get inlined] [fastrpc_map_lookup inlined] fastrpc_map_create fastrpc_internal_invoke fastrpc_device_ioctl __arm64_sys_ioctl invoke_syscall

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Linux Linux

Default version status: unaffected

  • c68cfb718c8f97b7f7a50ed66be5feb42d0c8988 to < 556dfdb226ce1e5231d8836159b23f8bb0395bf4affected
  • c68cfb718c8f97b7f7a50ed66be5feb42d0c8988 to < b171d0d2cf1b8387c72c8d325c5d5746fa271e39affected
  • c68cfb718c8f97b7f7a50ed66be5feb42d0c8988 to < 61a0890cb95afec5c8a2f4a879de2b6220984ef1affected
  • c68cfb718c8f97b7f7a50ed66be5feb42d0c8988 to < 079c78c68714f7d8d58e66c477b0243b31806907affected
  • c68cfb718c8f97b7f7a50ed66be5feb42d0c8988 to < 96b328d119eca7563c1edcc4e1039a62e6370ecbaffected

Linux Linux

Default version status: affected

  • 5.1affected
  • 0 to < 5.1unaffected
  • 5.4.230 to ≤ 5.4.*unaffected
  • 5.10.165 to ≤ 5.10.*unaffected
  • 5.15.90 to ≤ 5.15.*unaffected
  • 6.1.8 to ≤ 6.1.*unaffected
  • 6.2 to ≤ *unaffected

References