CVE-2022-4696: Use After Free
In static initializers of iouring.c, there is an insecure default value. This could lead to local escalation of privilege in the kernel with no additional execution privileges needed. User interaction is not needed for exploitation.
Other sources
There exists a use-after-free vulnerability in the Linux kernel through iouring and the IORINGOPSPLICE operation. If IORINGOPSPLICE is missing the IOWQWORKFILES flag, which signals that the operation won't use current->nsproxy, so its reference counter is not increased. This assumption is not always true as calling iosplice on specific files will call the getuts function which will use current->nsproxy leading to invalidly decreasing its reference counter later causing the use-after-free vulnerability. We recommend upgrading to version 5.10.160 or above
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.14.6-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1 - Upgrade
Upgrade
android/:linux_kernel:to a version that resolves this vulnerability.Fixed in :2023-04-05 - Upgrade
Upgrade
Linux kernelto a version that resolves this vulnerability.Fixed in 5.10.160
Event History
Frequently Asked Questions
What is CVE-2022-4696?
CVE-2022-4696 is a use-after-free vulnerability in the Linux kernel through io_uring and the IORING_OP_SPLICE operation.
How does CVE-2022-4696 impact Linux kernel?
CVE-2022-4696 can be exploited to cause a use-after-free condition in the Linux kernel, potentially leading to arbitrary code execution or a denial-of-service (DoS) attack.
What is the severity of CVE-2022-4696?
CVE-2022-4696 has a severity rating of high.
How can I fix CVE-2022-4696?
To fix CVE-2022-4696, you should update your Linux kernel to the recommended versions provided by Debian.
Where can I find more information about CVE-2022-4696?
You can find more information about CVE-2022-4696 on the Debian security tracker and the Kernel Dance website.