CVE-2022-1195: Use After Free
A use-after-free vulnerability was found in drivers/net/hamradio in the Linux kernel. In this flaw, a local attacker with a user privilege may lead to a denial of service (DOS) problem, when mkiss or sixpack device is detached, and reclaim resources early.
Reference:
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=b2f37aead1b82a770c48b5d583f35ec22aabb61e https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=81b1d548d00bcd028303c4f3150fa753b9b8aa71 https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=0b9111922b1f399aba6ed1e1b8f2079c3da1aed8 https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=3e0588c291d6ce225f2b891753ca41d45ba42469
================================================================== [ 26.882075] BUG: KASAN: use-after-free in ttyinsertflipstringfixedflag+0xd8/0x1e0 [ 26.882075] Read of size 85 at addr ffff88800690d000 by task trigger/141 [ 26.882075] [ 26.882075] CPU: 3 PID: 141 Comm: trigger Not tainted 5.11.0 #6 [ 26.882075] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014 [ 26.882075] Call Trace: [ 26.882075] dumpstack+0x7d/0xa3 [ 26.882075] printaddressdescription.constprop.0+0x18/0x130 [ 26.882075] ? ttyinsertflipstringfixedflag+0xd8/0x1e0 [ 26.882075] ? ttyinsertflipstringfixedflag+0xd8/0x1e0 [ 26.882075] kasanreport.cold+0x7f/0x10e [ 26.882075] ? ttyinsertflipstringfixedflag+0xd8/0x1e0 [ 26.882075] checkmemoryregion+0xf9/0x1e0 [ 26.882075] memcpy+0x20/0x60 [ 26.882075] ttyinsertflipstringfixedflag+0xd8/0x1e0 [ 26.882075] ptywrite+0xfa/0x1b0 [ 26.882075] ? ptysettermios+0x5d0/0x5d0 [ 26.882075] axencaps+0x9c9/0xb60 [ 26.882075] axxmit+0x36a/0x37e [ 26.882075] devhardstartxmit+0x160/0x500 [ 26.882075] schdirectxmit+0x20b/0xa00 [ 26.882075] ? qdiscputunlocked+0x50/0x50 [ 26.882075] ? sysvecapictimerinterrupt+0x33/0xd0 [ 26.882075] ? pfifofastdequeue+0x275/0xa30 [ 26.882075] qdiscrun+0x3a0/0x1390 [ 26.882075] devqueuexmit+0xabb/0x1b10 [ 26.882075] ? netdevcorepicktx+0x2a0/0x2a0 [ 26.882075] ? sysvecapictimerinterrupt+0x33/0xd0 [ 26.882075] ? memcpy+0x39/0x60 [ 26.882075] ? ax25addrbuild+0x7e/0x2a0 [ 26.882075] ax25sendmsg+0xb70/0x1090 [ 26.882075] ? selinuxinodenotifysecctx+0x20/0x20 [ 26.882075] ? ax25deviceevent+0x210/0x210 [ 26.882075] ? fgetfiles+0x15b/0x210 [ 26.882075] ? ax25deviceevent+0x210/0x210 [ 26.882075] socksendmsg+0xdf/0x110 [ 26.882075] syssendto+0x19e/0x270 [ 26.882075] ? ia32sysgetpeername+0xa0/0xa0 [ 26.882075] ? copyinitfpstatetofpregs+0x70/0x70 [ 26.882075] x64syssendto+0xd8/0x1b0 [ 26.882075] ? exittousermodeprepare+0x2c/0x120 [ 26.882075] dosyscall64+0x33/0x40 [ 26.882075] entrySYSCALL64afterhwframe+0x44/0xa9 <..> ==================================================================
Other sources
A use-after-free vulnerability was found in the Linux kernel in drivers/net/hamradio. This flaw allows a local attacker with a user privilege to cause a denial of service (DOS) when the mkiss or sixpack device is detached and reclaim resources early.
— Launchpad
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 5.16 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.113-1Fixed in 7.2.12-1 - Upgrade
Upgrade
Linux kernelto a version that resolves this vulnerability.Patch 0b9111922b1f399aba6ed1e1b8f2079c3da1aed8 - Upgrade
Upgrade
Linux kernelto a version that resolves this vulnerability.Patch 3e0588c291d6ce225f2b891753ca41d45ba42469 - Upgrade
Upgrade
Linux kernelto a version that resolves this vulnerability.Patch 81b1d548d00bcd028303c4f3150fa753b9b8aa71 - Upgrade
Upgrade
Linux kernelto a version that resolves this vulnerability.Patch b2f37aead1b82a770c48b5d583f35ec22aabb61e
Event History
Frequently Asked Questions
What is the severity of CVE-2022-1195?
CVE-2022-1195 is categorized as a denial of service vulnerability affecting the Linux kernel.
How do I fix CVE-2022-1195?
To mitigate CVE-2022-1195, update your Linux kernel to version 5.16 or the patched versions specified by your distribution.
Which Linux systems are affected by CVE-2022-1195?
CVE-2022-1195 affects Linux kernel versions below 5.16 and certain Debian and Red Hat Linux distributions.
What type of attack can exploit CVE-2022-1195?
CVE-2022-1195 can be exploited by a local attacker to cause denial of service through a use-after-free condition.
Is CVE-2022-1195 a remote or local vulnerability?
CVE-2022-1195 is a local vulnerability that requires user privileges to exploit.