CVE-2022-45888: Use After Free
Published Nov 25, 2022
·Updated
An issue was discovered in the Linux kernel through 6.0.9. drivers/char/xillybus/xillyusb.c has a race condition and use-after-free during physical removal of a USB device.
Affected Software
128 affected componentsFixes available
Linux Linux kernel<=6.0.9
NetApp H410c Firmware
NetApp H410c
NetApp H300s Firmware
NetApp H300s
NetApp H500s Firmware
NetApp H500s
NetApp H700s Firmware
NetApp H700s
NetApp H410s Firmware
NetApp H410s
All of the following
NetApp H410c Firmware
NetApp H410c
All of the following
NetApp H300s Firmware
NetApp H300s
All of the following
NetApp H500s Firmware
NetApp H500s
All of the following
NetApp H700s Firmware
NetApp H700s
All of the following
NetApp H410s Firmware
NetApp H410s
debian/linux<6.1.119-1
6.1.119-1
debian/linux<6.3.7-1
6.3.7-1
debian/linux<6.3.7-1
6.3.7-1
ubuntu/linux-hwe-edge*
ubuntu/linux-aws-5.0*
ubuntu/linux-aws-5.3*
ubuntu/linux-azure*
ubuntu/linux-azure-5.3*
ubuntu/linux-azure-edge*
ubuntu/linux-gcp*
ubuntu/linux-gcp-5.3*
ubuntu/linux-gke-4.15*
ubuntu/linux-gke-5.4*
ubuntu/linux-gkeop-5.4*
ubuntu/linux-hwe*
ubuntu/linux-oem*
ubuntu/linux-oracle-5.0*
ubuntu/linux-oracle-5.3*
ubuntu/linux-aws-5.11*
ubuntu/linux-aws-5.13*
ubuntu/linux-aws-5.15*
ubuntu/linux-aws-5.8*
ubuntu/linux-azure-5.11*
ubuntu/linux-azure-5.13*
ubuntu/linux-azure-5.15*
ubuntu/linux-azure-5.8*
ubuntu/linux-azure-fde-5.15*
ubuntu/linux-gcp-5.11*
ubuntu/linux-gcp-5.13*
ubuntu/linux-gcp-5.15*
ubuntu/linux-gcp-5.8*
ubuntu/linux-gke-5.15*
ubuntu/linux-gkeop-5.15*
ubuntu/linux-hwe-5.11*
ubuntu/linux-hwe-5.13*
ubuntu/linux-hwe-5.15*
ubuntu/linux-hwe-5.8*
ubuntu/linux-ibm-5.15*
ubuntu/linux-intel-5.13*
ubuntu/linux-intel-iotg-5.15*
ubuntu/linux-lowlatency-hwe-5.15*
ubuntu/linux-nvidia-tegra-5.15*
ubuntu/linux-oem-5.10*
ubuntu/linux-oem-5.13*
ubuntu/linux-oem-5.6*
ubuntu/linux-oracle-5.11*
ubuntu/linux-oracle-5.13*
ubuntu/linux-oracle-5.15*
ubuntu/linux-oracle-5.8*
ubuntu/linux-raspi2*
ubuntu/linux-riscv*
ubuntu/linux-riscv-5.11*
ubuntu/linux-riscv-5.15*
ubuntu/linux-riscv-5.8*
ubuntu/linux*
ubuntu/linux-allwinner-5.19*
ubuntu/linux-aws*
ubuntu/linux-aws-5.19*
ubuntu/linux-aws-6.2*
ubuntu/linux-azure*
ubuntu/linux-azure-5.19*
ubuntu/linux-azure-6.2*
ubuntu/linux-azure-fde*
ubuntu/linux-azure-fde-5.19*
ubuntu/linux-azure-fde-6.2*
ubuntu/linux-gcp*
ubuntu/linux-gcp-5.19*
ubuntu/linux-gcp-6.2*
ubuntu/linux-gke*
ubuntu/linux-gkeop*
ubuntu/linux-hwe-5.19*
ubuntu/linux-hwe-6.2*
ubuntu/linux-ibm*
ubuntu/linux-intel-iot-realtime*
ubuntu/linux-intel-iotg*
ubuntu/linux-kvm*
ubuntu/linux-lowlatency*
ubuntu/linux-lowlatency-hwe-5.19*
ubuntu/linux-lowlatency-hwe-6.2*
ubuntu/linux-nvidia*
ubuntu/linux-nvidia-6.2*
ubuntu/linux-nvidia-tegra*
ubuntu/linux-nvidia-tegra-igx*
ubuntu/linux-oem-5.17*
ubuntu/linux-oem-6.0*
ubuntu/linux-oem-6.1*
ubuntu/linux-oracle*
ubuntu/linux-raspi*
ubuntu/linux-realtime*
ubuntu/linux-riscv*
ubuntu/linux-riscv-5.19*
ubuntu/linux-starfive-5.19*
ubuntu/linux-starfive-6.2*
ubuntu/linux-xilinx-zynqmp*
ubuntu/linux-bluefield*
ubuntu/linux-intel-iot-realtime*
ubuntu/linux-realtime*
ubuntu/linux-aws-fips*
ubuntu/linux-azure-fips*
ubuntu/linux-fips*
ubuntu/linux-gcp-fips*
ubuntu/linux-aws-fips*
ubuntu/linux-azure-fips*
ubuntu/linux-fips*
ubuntu/linux-gcp-fips*
ubuntu/linux-raspi-realtime*
debian/linux
6.1.176-16.1.190-16.12.107-16.12.116-17.2.15-17.3.3-1
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.119-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.3.7-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.116-1Fixed in 7.2.15-1Fixed in 7.3.3-1
Event History
Nov 25, 2022
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
Description
Data Sourced
via OSV·04:15 AM
DescriptionSeverityAffected Software
Data Sourced
via NVD·04:15 AM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is CVE-2022-45888?
CVE-2022-45888 is a vulnerability discovered in the Linux kernel through version 6.0.9.
2
What is the severity of CVE-2022-45888?
CVE-2022-45888 has a severity rating of 6.4, which is considered medium.
3
Which software is affected by CVE-2022-45888?
The Linux kernel through version 6.0.9 and Netapp H410c Firmware are affected by CVE-2022-45888.
4
What is the impact of CVE-2022-45888?
CVE-2022-45888 can lead to a race condition and use-after-free vulnerability during physical removal of a USB device.
5
Are macOS versions affected by CVE-2022-45888?
No, Apple macOS versions (Big Sur, Ventura, and Monterey) are not vulnerable to CVE-2022-45888.