CVE-2022-4744: Double Free
A double-free flaw was found in the Linux kernel’s TUN/TAP device driver functionality in how a user registers the device when the registernetdevice function fails (NETDEVREGISTER notifier). This flaw allows a local user to crash or potentially escalate their privileges on the system.
Other sources
A flaw in the Linux Kernel found. If patch 158b515f703e ("tun: avoid double free in tunfreenetdev") not applied, then user can call registernetdevice() to fail that can lead to double free. One way to make a NETDEVREGISTER notifier fail is to create a device with name "default" or "all", which will be vetoed by devinetsysctlregister() because sysctldevnameisallowed() detects that the name is a reserved entry name in /proc/sys/net/ipv4/conf/.
Reference: https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git/commit/?id=158b515f703e
— Red Hat
Linux Kernel could allow a local authenticated attacker to gain elevated privileges on the system, caused by a double-free flaw in the TUN/TAP device driver functionality. An attacker could exploit this vulnerability to gain elevated privileges.
— IBM
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 0:5.14.0-162.22.2.el9_1 - Upgrade
Upgrade
redhat/kernel-rtto a version that resolves this vulnerability.Fixed in 0:5.14.0-162.22.2.rt21.186.el9_1 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 0:5.14.0-70.50.2.el9_0 - Upgrade
Upgrade
redhat/kernel-rtto a version that resolves this vulnerability.Fixed in 0:5.14.0-70.50.2.rt21.122.el9_0 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 5.16 - Upgrade
Upgrade
Linux kernel TUN/TAP device driverto a version that resolves this vulnerability.Patch 158b515f703e - Compensating control
Prevent the tun kernel module from being loaded, such as by blacklisting the module.
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2022-4744?
CVE-2022-4744 is categorized as a high severity vulnerability due to its potential to allow privilege escalation.
How do I fix CVE-2022-4744?
To fix CVE-2022-4744, you should update your Linux kernel to one of the remedied versions listed by Red Hat, such as 0:5.14.0-162.22.2.el9_1 or higher.
Who is affected by CVE-2022-4744?
CVE-2022-4744 affects Linux kernels and certain IBM Security Verify Governance versions, making users of these systems potentially vulnerable.
What kind of attack can CVE-2022-4744 enable?
CVE-2022-4744 can enable a local user to crash the system or escalate their privileges.
Is CVE-2022-4744 specific to certain Linux distributions?
Yes, CVE-2022-4744 primarily affects Red Hat-based distributions, including those using the kernel and kernel-rt packages.