4.7

CVE-2022-48899

drm/virtio: Fix GEM handle creation UAF

In the Linux kernel, the following vulnerability has been resolved:

drm/virtio: Fix GEM handle creation UAF

Userspace can guess the handle value and try to race GEM object creation
with handle close, resulting in a use-after-free if we dereference the
object after dropping the handle's reference.  For that reason, dropping
the handle's reference must be done *after* we are done dereferencing
the object.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Linux ≫ Linux Kernel Version >= 4.4 < 4.19.270
Linux ≫ Linux Kernel Version >= 4.20 < 5.4.229
Linux ≫ Linux Kernel Version >= 5.5 < 5.10.164
Linux ≫ Linux Kernel Version >= 5.11 < 5.15.89
Linux ≫ Linux Kernel Version >= 5.16 < 6.1.7
Linux ≫ Linux Kernel Version 6.2 Update rc1
Linux ≫ Linux Kernel Version 6.2 Update rc2
Linux ≫ Linux Kernel Version 6.2 Update rc3
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.25% 0.158
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 4.7 1 3.6
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
416baaa9-dc9f-4396-8d5f-8c081fb06d67 7.8 1.8 5.9
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE-416 Use After Free

The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

https://git.kernel.org/stable/c/011ecdbcd520c90c344b872ca6b4821f7783b2f8
Patch
https://git.kernel.org/stable/c/19ec87d06acfab2313ee82b2a689bf0c154e57ea
Patch
https://git.kernel.org/stable/c/52531258318ed59a2dc5a43df2eaf0eb1d65438e
Patch
https://git.kernel.org/stable/c/68bcd063857075d2f9edfed6024387ac377923e2
Patch
https://git.kernel.org/stable/c/adc48e5e408afbb01d261bd303fd9fbbbaa3e317
Patch
https://git.kernel.org/stable/c/d01d6d2b06c0d8390adf8f3ba08aa60b5642ef73
Patch