CVE-2022-22942: Use After Free
A failing usercopy of the fencerep object will lead to a stale entry in the file descriptor table as putunusedfd() won't release it. This enables userland to refer to a dangling 'file' object through that still valid file descriptor, leading to all kinds of use-after-free exploitation scenarios.
Other sources
A use-after-free flaw was found in the Linux kernel’s vmwexecbufcopyfenceuser function in drivers/gpu/drm/vmwgfx/vmwgfxexecbuf.c in vmwgfx. This flaw allows a local attacker with user privileges to cause a privilege escalation problem.
The vmwgfx driver contains a local privilege escalation vulnerability that allows unprivileged users to gain access to files opened by other processes on the system through a dangling 'file' pointer.
— Launchpad
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/kernel-rtto a version that resolves this vulnerability.Fixed in 0:3.10.0-1160.59.1.rt56.1200.el7 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 0:3.10.0-1160.59.1.el7 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 0:3.10.0-957.92.1.el7 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 0:3.10.0-1062.66.1.el7 - Upgrade
Upgrade
redhat/kernel-rtto a version that resolves this vulnerability.Fixed in 0:4.18.0-348.20.1.rt7.150.el8_5 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 0:4.18.0-348.20.1.el8_5 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 0:4.18.0-147.64.1.el8_1 - Upgrade
Upgrade
redhat/kernel-rtto a version that resolves this vulnerability.Fixed in 0:4.18.0-193.79.1.rt13.129.el8_2 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 0:4.18.0-193.79.1.el8_2 - Upgrade
Upgrade
redhat/kernel-rtto a version that resolves this vulnerability.Fixed in 0:4.18.0-305.40.1.rt7.112.el8_4 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 0:4.18.0-305.40.1.el8_4 - Upgrade
Upgrade
redhat/redhat-virtualization-hostto a version that resolves this vulnerability.Fixed in 0:4.3.22-20220330.1.el7_9 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.25-1 - Upgrade
Upgrade
redhat/Kernelto a version that resolves this vulnerability.Fixed in 5.16 - Configuration
Blacklist the affected vmwgfx kernel module to prevent it from loading automatically at boot until a fix is available.
Linux kernel module loader vmwgfx = blacklisted
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2022-22942?
CVE-2022-22942 is considered a critical security vulnerability due to the potential for use-after-free exploitation.
How do I fix CVE-2022-22942?
You can fix CVE-2022-22942 by updating your kernel to the patched versions provided by Red Hat as listed in the affected software section.
Which software versions are affected by CVE-2022-22942?
CVE-2022-22942 affects various versions of Red Hat's kernel and kernel-rt including kernels prior to 3.10.0-1160.59.1.el7 and 4.18.0-348.20.1.el8_5.
What are the risks of not addressing CVE-2022-22942?
Not addressing CVE-2022-22942 may lead to exploitation through dangling file objects, resulting in unauthorized access and potential system compromise.
Is CVE-2022-22942 specific to any operating system?
Yes, CVE-2022-22942 specifically affects Red Hat-based Linux distributions and VMware Photon OS.