Debian: CVE-2022-48779: linux -- security update

Debian: CVE-2022-48779: linux -- security update

Severity

7

CVSS

(AV:L/AC:L/Au:S/C:C/I:C/A:C)

Published

07/30/2024

Created

07/31/2024

Added

07/30/2024

Modified

01/30/2025

Description

In the Linux kernel, the following vulnerability has been resolved: net: mscc: ocelot: fix use-after-free in ocelot_vlan_del() ocelot_vlan_member_del() will free the struct ocelot_bridge_vlan, so if this is the same as the port's pvid_vlan which we access afterwards, what we're accessing is freed memory. Fix the bug by determining whether to clear ocelot_port->pvid_vlan prior to calling ocelot_vlan_member_del().

Solution(s)

• debian-upgrade-linux

References

• https://attackerkb.com/topics/cve-2022-48779
• CVE - 2022-48779