CVE-2022-50454: drm/nouveau: fix a use-after-free in nouveau_gem_prime_import_sg_table()
In the Linux kernel, the following vulnerability has been resolved:
drm/nouveau: fix a use-after-free in nouveaugemprimeimportsgtable()
nouveauboinit() is backed by ttmboinit() and ferries its return code back to the caller. On failures, ttm will call nouveaubodelttm() and free the memory.Thus, when nouveauboinit() returns an error, the gem object has already been released. Then the call to nouveauboref() will use the freed "nvbo->bo" and lead to a use-after-free bug.
We should delete the call to nouveauboref() to avoid the use-after-free.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2022-50454?
CVE-2022-50454 is rated as high severity due to its potential for causing a use-after-free condition in the Linux kernel.
How do I fix CVE-2022-50454?
To fix CVE-2022-50454, update to the latest stable version of the Linux kernel that includes the patch addressing this vulnerability.
What does CVE-2022-50454 affect?
CVE-2022-50454 affects the Linux kernel, specifically the nouveau graphics driver within the DRM subsystem.
What are the implications of CVE-2022-50454?
Exploiting CVE-2022-50454 could allow an attacker to execute arbitrary code in the context of the kernel, potentially compromising system integrity.
How was CVE-2022-50454 discovered?
CVE-2022-50454 was discovered during routine kernel development and testing, focusing on the nouveau graphics driver functions.