CVE-2022-50411: ACPICA: Fix error code path in acpi_ds_call_control_method()
In the Linux kernel, the following vulnerability has been resolved:
ACPICA: Fix error code path in acpidscallcontrolmethod()
A use-after-free in acpipsparseaml() after a failing invocaion of acpidscallcontrolmethod() is reported by KASAN [1] and code inspection reveals that nextwalkstate pushed to the thread by acpidscreatewalkstate() is freed on errors, but it is not popped from the thread beforehand. Thus acpidsgetcurrentwalkstate() called by acpipsparseaml() subsequently returns it as the new walk state which is incorrect.
To address this, make acpidscallcontrolmethod() call acpidspopwalkstate() to pop nextwalkstate from the thread before returning an error.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Modify acpi_ds_call_control_method() so that when next_walk_state is pushed to the thread and an error occurs, it is popped via acpi_ds_pop_walk_state() before acpi_ps_parse_aml() subsequently receives/returns the incorrect walk state, preventing the use-after-free triggered after failing invocation (ACPICA: Fix error code path in acpi_ds_call_control_method()).
Linux kernel (ACPICA) acpi_ds_call_control_method() error handling = Call acpi_ds_pop_walk_state() to pop next_walk_state from the thread before returning on error
Event History
Frequently Asked Questions
What is the severity of CVE-2022-50411?
CVE-2022-50411 has a high severity rating due to its potential for exploitation affecting memory management in the Linux kernel.
How do I fix CVE-2022-50411?
To fix CVE-2022-50411, update your Linux kernel to the fixed version provided by your distribution.
What systems are affected by CVE-2022-50411?
CVE-2022-50411 specifically affects the Linux kernel across various distributions.
What does CVE-2022-50411 exploit?
CVE-2022-50411 exploits a use-after-free vulnerability during the invocation of control methods in ACPI.
Has CVE-2022-50411 been resolved?
Yes, CVE-2022-50411 has been resolved in newer versions of the Linux kernel.