Debian: CVE-2022-48872: linux -- security update

Debian: CVE-2022-48872: linux -- security update

Severity

7

CVSS

(AV:L/AC:M/Au:S/C:C/I:C/A:C)

Published

08/22/2024

Created

08/23/2024

Added

08/22/2024

Modified

01/30/2025

Description

In the Linux kernel, the following vulnerability has been resolved: misc: fastrpc: Fix use-after-free race condition for maps It is possible that in between calling fastrpc_map_get() until map->fl->lock is taken in fastrpc_free_map(), another thread can call fastrpc_map_lookup() and get a reference to a map that is about to be deleted. Rewrite fastrpc_map_get() to only increase the reference count of a map if it's non-zero. Propagate this to callers so they can know if a map is about to be deleted. Fixes this warning: refcount_t: addition on 0; use-after-free. WARNING: CPU: 5 PID: 10100 at lib/refcount.c:25 refcount_warn_saturate ... Call trace: refcount_warn_saturate [fastrpc_map_get inlined] [fastrpc_map_lookup inlined] fastrpc_map_create fastrpc_internal_invoke fastrpc_device_ioctl __arm64_sys_ioctl invoke_syscall

Solution(s)

• debian-upgrade-linux

References

• https://attackerkb.com/topics/cve-2022-48872
• CVE - 2022-48872