CVE-2022-22942: Use After Free
A failing usercopy of the fencerep object will lead to a stale entry in the file descriptor table as putunusedfd() won't release it. This enables userland to refer to a dangling 'file' object through that still valid file descriptor, leading to all kinds of use-after-free exploitation scenarios.
Other sources
A use-after-free flaw was found in the Linux kernel’s vmwexecbufcopyfenceuser function in drivers/gpu/drm/vmwgfx/vmwgfxexecbuf.c in vmwgfx. This flaw allows a local attacker with user privileges to cause a privilege escalation problem.
The vmwgfx driver contains a local privilege escalation vulnerability that allows unprivileged users to gain access to files opened by other processes on the system through a dangling 'file' pointer.
— Launchpad
Affected Software
Remediation
Information
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2022-22942?
CVE-2022-22942 is considered a critical security vulnerability due to the potential for use-after-free exploitation.
How do I fix CVE-2022-22942?
You can fix CVE-2022-22942 by updating your kernel to the patched versions provided by Red Hat as listed in the affected software section.
Which software versions are affected by CVE-2022-22942?
CVE-2022-22942 affects various versions of Red Hat's kernel and kernel-rt including kernels prior to 3.10.0-1160.59.1.el7 and 4.18.0-348.20.1.el8_5.
What are the risks of not addressing CVE-2022-22942?
Not addressing CVE-2022-22942 may lead to exploitation through dangling file objects, resulting in unauthorized access and potential system compromise.
Is CVE-2022-22942 specific to any operating system?
Yes, CVE-2022-22942 specifically affects Red Hat-based Linux distributions and VMware Photon OS.