CVE-2022-41849: Race Condition
drivers/video/fbdev/smscufx.c in the Linux kernel through 5.19.12 has a race condition and resultant use-after-free if a physically proximate attacker removes a USB device while calling open(), aka a race condition between ufxopsopen and ufxusbdisconnect.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.22-1Fixed in 6.12.25-1
Event History
Frequently Asked Questions
What is the severity of CVE-2022-41849?
CVE-2022-41849 is classified as a medium severity vulnerability due to its potential for a use-after-free condition.
How do I fix CVE-2022-41849?
To fix CVE-2022-41849, upgrade to a fixed version of the Linux kernel such as 5.10.223-1 or newer.
Which versions of the Linux kernel are affected by CVE-2022-41849?
CVE-2022-41849 affects the Linux kernel versions up to and including 5.19.12.
What causes the vulnerability in CVE-2022-41849?
The vulnerability is caused by a race condition between the ufx_ops_open and ufx_usb_disconnect functions when a USB device is removed.
Is CVE-2022-41849 specific to any particular Linux distribution?
CVE-2022-41849 impacts various distributions, including Debian Linux version 10.0 and the Linux kernel.