CVE-2022-29581: Use After Free
A use-after-free flaw was found in u32change in net/sched/clsu32.c in the network subcomponent of the Linux kernel. This flaw could allow a local attacker to crash the system and cause a privilege escalation, and a kernel information leak problem.
References and upstream patch: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=3db09e762dc79584a69c10d74a6b98f89a9979f8 https://kernel.dance/#3db09e762dc79584a69c10d74a6b98f89a9979f8
Other sources
A use-after-free flaw was found in u32change in net/sched/clsu32.c in the network subcomponent of the Linux kernel. This flaw allows a local attacker to crash the system, cause a privilege escalation, and leak kernel information.
Improper Update of Reference Count vulnerability in net/sched of Linux Kernel allows local attacker to cause privilege escalation to root. This issue affects: Linux Kernel versions prior to 5.18; version 4.14 and later versions.
In u32destroykey and related functions of clsu32.c, there is a possible way to corrupt memory due to a use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
— OSV
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/kernel-rtto a version that resolves this vulnerability.Fixed in 0:4.18.0-425.3.1.rt7.213.el8 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 0:4.18.0-425.3.1.el8 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 0:5.14.0-162.6.1.el9_1 - Upgrade
Upgrade
redhat/kernel-rtto a version that resolves this vulnerability.Fixed in 0:5.14.0-162.6.1.rt21.168.el9_1 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 5.18 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1 - Upgrade
Upgrade
android/:linux_kernel:to a version that resolves this vulnerability.Fixed in :2022-08-05 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.17.6-1 - Configuration
Blacklist the cls_u32 module to prevent it from being loaded automatically.
Linux kernel cls_u32 module module blacklist = cls_u32
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2022-29581?
CVE-2022-29581 is considered high severity due to its potential for local privilege escalation and system crashes.
How do I fix CVE-2022-29581?
To remediate CVE-2022-29581, upgrade to a fixed version of the Linux kernel according to the available patches for your distribution.
Which systems are affected by CVE-2022-29581?
CVE-2022-29581 affects various Linux kernel versions across different distributions including Red Hat, Debian, and Ubuntu.
What happens if CVE-2022-29581 is exploited?
Exploitation of CVE-2022-29581 could lead to a local attacker gaining elevated privileges and causing a system crash.
Is there a patch available for CVE-2022-29581?
Yes, patches for CVE-2022-29581 are provided in kernel updates by affected Linux distributions.