CVE-2022-48670: peci: cpu: Fix use-after-free in adev_release()
In the Linux kernel, the following vulnerability has been resolved:
peci: cpu: Fix use-after-free in adevrelease()
When auxiliarydeviceadd() returns an error, auxiliarydeviceuninit() is called, which causes refcount for device to be decremented and .release callback will be triggered.
Because adevrelease() re-calls auxiliarydeviceuninit(), it will cause use-after-free: [ 1269.455172] WARNING: CPU: 0 PID: 14267 at lib/refcount.c:28 refcountwarnsaturate+0x110/0x15 [ 1269.464007] refcountt: underflow; use-after-free.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2022-48670?
CVE-2022-48670 has been classified as a medium severity vulnerability in the Linux kernel.
How do I fix CVE-2022-48670?
To fix CVE-2022-48670, you should update your Linux kernel to versions 5.19.10 or later, or to 6.0-rc4 or later.
What kind of vulnerability is CVE-2022-48670?
CVE-2022-48670 is a use-after-free vulnerability affecting the auxiliary device handling in the Linux kernel.
Which Linux kernel versions are affected by CVE-2022-48670?
CVE-2022-48670 affects Linux kernel versions from 5.18 up to 5.19.10 and specific 6.0 release candidates.
What are the potential impacts of CVE-2022-48670?
Exploitation of CVE-2022-48670 could lead to denial of service or potential arbitrary code execution due to memory corruption.