CVE-2022-50423: ACPICA: Fix use-after-free in acpi_ut_copy_ipackage_to_ipackage()
In the Linux kernel, the following vulnerability has been resolved:
ACPICA: Fix use-after-free in acpiutcopyipackagetoipackage()
There is an use-after-free reported by KASAN:
BUG: KASAN: use-after-free in acpiutremovereference+0x3b/0x82 Read of size 1 at addr ffff888112afc460 by task modprobe/2111 CPU: 0 PID: 2111 Comm: modprobe Not tainted 6.1.0-rc7-dirty Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), Call Trace: <TASK> kasanreport+0xae/0xe0 acpiutremovereference+0x3b/0x82 acpiutcopyiobjecttoiobject+0x3be/0x3d5 acpidsstoreobjecttolocal+0x15d/0x3a0 acpiexstore+0x78d/0x7fd acpiexopcode1A1T1R+0xbe4/0xf9b acpipsparseaml+0x217/0x8d5 ... </TASK>
The root cause of the problem is that the acpioperandobject is freed when acpiutwalkpackagetree() fails in acpiutcopyipackagetoipackage(), lead to repeated release in acpiutcopyiobjecttoiobject(). The problem was introduced by "8aa5e56eeb61" commit, this commit is to fix memory leak in acpiutcopyiobjecttoiobject(), repeatedly adding remove operation, lead to "acpioperandobject" used after free.
Fix it by removing acpiutremovereference() in acpiutcopyipackagetoipackage(). acpiutcopyipackagetoipackage() is called to copy an internal package object into another internal package object, when it fails, the memory of acpioperandobject should be freed by the caller.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
acpi_ut_remove_reference()from your environment.Fix the reported KASAN use-after-free by removing the call to acpi_ut_remove_reference() in acpi_ut_copy_ipackage_to_ipackage().
Event History
Frequently Asked Questions
What is the severity of CVE-2022-50423?
CVE-2022-50423 is classified as a medium severity vulnerability due to its potential for exploitation in the Linux kernel.
How do I fix CVE-2022-50423?
To mitigate CVE-2022-50423, you should update to the latest patched version of the Linux kernel provided by your distribution.
What is the nature of the vulnerability in CVE-2022-50423?
CVE-2022-50423 involves a use-after-free condition in the Linux kernel's ACPICA subsystem.
Which versions of Linux kernel are affected by CVE-2022-50423?
CVE-2022-50423 affects multiple versions of the Linux kernel, particularly versions before 6.1.2.
What are the potential consequences of exploiting CVE-2022-50423?
Exploiting CVE-2022-50423 could lead to memory corruption and potentially allow an attacker to execute arbitrary code on the affected system.