CVE-2022-49085
drbd: Fix five use after free bugs in get_initial_state
At a glance
- Source
- NVD
- EPSS
- EPSS 0.28 % · percentile 21 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- Linux
- NVD status
- Analyzed
Description
In the Linux kernel, the following vulnerability has been resolved: drbd: Fix five use after free bugs in get_initial_state In get_initial_state, it calls notify_initial_state_done(skb,..) if cb->args[5]==1. If genlmsg_put() failed in notify_initial_state_done(), the skb will be freed by nlmsg_free(skb). Then get_initial_state will goto out and the freed skb will be used by return value skb->len, which is a uaf bug. What's worse, the same problem goes even further: skb can also be freed in the notify_*_state_change -> notify_*_state calls below. Thus 4 additional uaf bugs happened. My patch lets the problem callee functions: notify_initial_state_done and notify_*_state_change return an error code if errors happen. So that the error codes could be propagated and the uaf bugs can be avoid. v2 reports a compilation warning. This v3 fixed this warning and built successfully in my local environment with no additional warnings. v2: https://lore.kernel.org/patchwork/patch/1435218/
Weaknesses (CWE)
- CWE-416 — Use After Free
References
- https://git.kernel.org/stable/c/0489700bfeb1e53eb2039c2291c67e71b0b40103
- https://git.kernel.org/stable/c/dcf6be17b5c53b741898d2223b23e66d682de300
- https://git.kernel.org/stable/c/188fe6b26765edbad4055611c0f788b6870f4024
- https://git.kernel.org/stable/c/b6a4055036eed1f5e239ce3d8b0db1ce38bba447
- https://git.kernel.org/stable/c/594205b4936771a250f9d141e7e0fff21c3dd2d9
- https://git.kernel.org/stable/c/a972c768723359ec995579902473028fe3cd64b1
- https://git.kernel.org/stable/c/de63e74da2333b4068bb79983e632db730fea97e
- https://git.kernel.org/stable/c/226e993c39405292781bfcf4b039a8db56aab362
- https://git.kernel.org/stable/c/aadb22ba2f656581b2f733deb3a467c48cc618f6
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | HIGH 7.8 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H | Linux |
| CVSS 3.1 | HIGH 7.8 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H | CISA-ADP |
| CVSS 3.1 | HIGH 7.8 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H | NVD · 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary) |
European references
- ENISA EUVD · EUVD-2022-55119
- GCVE · GCVE-0-2022-49085
CERT-FR advisories
- CERTFR-2025-AVI-0336 — Multiples vulnérabilités dans le noyau Linux de SUSE · cert.ssi.gouv.fr
- CERTFR-2025-AVI-0307 — Multiples vulnérabilités dans le noyau Linux de SUSE · cert.ssi.gouv.fr
- CERTFR-2025-AVI-0252 — Multiples vulnérabilités dans le noyau Linux de SUSE · cert.ssi.gouv.fr
Affected configurations (NVD CPE)
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 4.5 < 4.9.311cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 4.10 < 4.14.276cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 4.15 < 4.19.238cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 4.20 < 5.4.189cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 5.5 < 5.10.111cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 5.11 < 5.15.34cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 5.16 < 5.16.20cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 5.17 < 5.17.3cpe:2.3:o:linux:linux_kernel:5.18:rc1:*:*:*:*:*:*
Affected products
| Product | Versions |
|---|---|
| Linux · Linux | affected a29728463b254ce81ecefdf20c1a02e01d9361da < 0489700bfeb1e53eb2039c2291c67e71b0b40103 ; affected a29728463b254ce81ecefdf20c1a02e01d9361da < dcf6be17b5c53b741898d2223b23e66d682de300 ; affected a29728463b254ce81ecefdf20c1a02e01d9361da < 188fe6b26765edbad4055611c0f788b6870f4024 ; affected a29728463b254ce81ecefdf20c1a02e01d9361da < b6a4055036eed1f5e239ce3d8b0db1ce38bba447 ; affected a29728463b254ce81ecefdf20c1a02e01d9361da < 594205b4936771a250f9d141e7e0fff21c3dd2d9 ; affected a29728463b254ce81ecefdf20c1a02e01d9361da < a972c768723359ec995579902473028fe3cd64b1 |
| Linux · Linux | affected 4.5 ; unaffected 0 < 4.5 ; unaffected 4.9.311 ≤ 4.9.* ; unaffected 4.14.276 ≤ 4.14.* ; unaffected 4.19.238 ≤ 4.19.* ; unaffected 5.4.189 ≤ 5.4.* |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |