CVE-2022-3424: Use After Free
A use after free flaw in the Linux Kernel SGI GRU driver in drivers/misc/sgi-gru/grufile.c found. A local user can call grufileunlockedioctl with GRUSETCONTEXTOPTION and then triggering error path in grucheckcontextplacement function. This leads to use after free in gruunloadcontext function.
Reference: https://www.spinics.net/lists/kernel/msg4518970.html
Besides, this is a long existing bug which was introduced in 13 years ago: https://github.com/torvalds/linux/commit/55484c45dbeca2eec7642932ec3f60f8a2d4bdbf
Other sources
A use-after-free flaw was found in the Linux kernel’s SGI GRU driver in the way the first grufileunlockedioctl function is called by the user, where a fail pass occurs in the grucheckchipletassignment function. This flaw allows a local user to crash or potentially escalate their privileges on the system.
— Launchpad
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.25-1Fixed in 6.12.27-1
Event History
Frequently Asked Questions
What is the severity of CVE-2022-3424?
CVE-2022-3424 is considered a high severity vulnerability due to the potential for local users to exploit a use after free condition in the Linux kernel.
How do I fix CVE-2022-3424?
To fix CVE-2022-3424, users should upgrade to the latest kernel versions that are not affected by this vulnerability.
Which versions of the Linux Kernel are affected by CVE-2022-3424?
CVE-2022-3424 affects multiple versions of the Linux Kernel including those between 2.6.33 and 4.9.337, as well as various ranges up to 6.1.2.
What is the impact of CVE-2022-3424 on system security?
The impact of CVE-2022-3424 could potentially allow a local user to gain unauthorized access or control over the system, leading to significant security breaches.
Who can exploit CVE-2022-3424?
CVE-2022-3424 can be exploited by local users with access to the system, specifically those able to call the gru_file_unlocked_ioctl function.