CVE-2022-41222: Use After Free
A flaw use after free found in Linux Kernel mm/mremap memory address space accounting source code. If race condition happens between rmap walk and mremap, this can result in stale TLB entries.
Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=97113eb39fa7972722ff490b947d8af023e1f6a2
Other sources
A use-after-free flaw was found in the Linux kernel’s mm/mremap memory address space accounting source code in how a race condition happens between rmap walk and mremap. This flaw allows a local user to crash or potentially escalate their privileges on the system.
mm/mremap.c in the Linux kernel before 5.13.3 has a use-after-free via a stale TLB because an rmap lock is not held during a PUD move.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/kernel-rtto a version that resolves this vulnerability.Fixed in 0:4.18.0-425.13.1.rt7.223.el8_7 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 0:4.18.0-425.13.1.el8_7 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 0:4.18.0-372.46.1.el8_6 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.22-1Fixed in 6.12.25-1 - Upgrade
Upgrade
linux kernelto a version that resolves this vulnerability.Fixed in 5.13.3 - Compensating control
To reduce risk from stale TLB entries caused by the rmap walk vs mremap race, consider restricting local (unprivileged) user access to affected systems until the kernel is updated to 5.13.3 or later.
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2022-41222?
CVE-2022-41222 has been assigned a medium severity rating due to its potential impact on memory management in the Linux Kernel.
How do I fix CVE-2022-41222?
To fix CVE-2022-41222, update the Linux Kernel to the recommended versions or later: 0:4.18.0-425.13.1.rt7.223.el8_7, 0:4.18.0-425.13.1.el8_7, or other specified versions.
Which Linux distributions are affected by CVE-2022-41222?
CVE-2022-41222 affects various distributions, including certain versions of Red Hat, Ubuntu, and Debian based on the Linux Kernel.
What types of systems are vulnerable due to CVE-2022-41222?
Systems running the affected versions of the Linux Kernel, including servers and desktop environments, are at risk from CVE-2022-41222.
Are there any workarounds for CVE-2022-41222?
There are no recommended workarounds for CVE-2022-41222; the best action is to apply the available patches.