CVE-2022-4696: Use After Free
There exists a use-after-free vulnerability in the Linux kernel through iouring and the IORINGOPSPLICE operation. If IORINGOPSPLICE is missing the IOWQWORKFILES flag, which signals that the operation won't use current->nsproxy, so its reference counter is not increased. This assumption is not always true as calling iosplice on specific files will call the getuts function which will use current->nsproxy leading to invalidly decreasing its reference counter later causing the use-after-free vulnerability. We recommend upgrading to version 5.10.160 or above
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 4.19.249-2Fixed in 4.19.289-2Fixed in 5.10.197-1Fixed in 5.10.191-1Fixed in 6.1.66-1Fixed in 6.1.69-1Fixed in 6.5.13-1Fixed in 6.6.8-1 - Upgrade
Upgrade
debian/linux-5.10to a version that resolves this vulnerability.Fixed in 5.10.197-1~deb10u1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 5.10.160
Event History
Frequently Asked Questions
What is CVE-2022-4696?
CVE-2022-4696 is a use-after-free vulnerability in the Linux kernel through io_uring and the IORING_OP_SPLICE operation.
How does CVE-2022-4696 impact Linux kernel?
CVE-2022-4696 can be exploited to cause a use-after-free condition in the Linux kernel, potentially leading to arbitrary code execution or a denial-of-service (DoS) attack.
What is the severity of CVE-2022-4696?
CVE-2022-4696 has a severity rating of high.
How can I fix CVE-2022-4696?
To fix CVE-2022-4696, you should update your Linux kernel to the recommended versions provided by Debian.
Where can I find more information about CVE-2022-4696?
You can find more information about CVE-2022-4696 on the Debian security tracker and the Kernel Dance website.