UBUNTU-CVE-2022-49114: Use After Free

Q: Which Ubuntu kernel package variants are identified as affected?

The listed packages are ubuntu/linux-fips, ubuntu/linux-azure, ubuntu/linux, ubuntu/linux-aws, ubuntu/linux-gcp, ubuntu/linux-oracle, ubuntu/linux-kvm, and ubuntu/linux-aws-fips.

Q: Does exploitation require credentials or user interaction?

The supplied vector indicates no privileges are required and no user interaction is required. It identifies adjacent-network attack access and low attack complexity, with attack requirements present.

Q: What impact is indicated if exploitation succeeds?

The vector rates confidentiality, integrity, and availability impact as high for the vulnerable system. It indicates no impact on a subsequent system.

Q: Are fixed package versions provided?

No fixed Ubuntu package versions are included in the provided information.

Published Feb 26, 2025

Updated

In the Linux kernel, the following vulnerability has been resolved: scsi: libfc: Fix use after free in fcexchabtsresp() fcexchrelease(ep) will decrease the ep's reference count. When the reference count reaches zero, it is freed. But ep is still used in the following code, which will lead to a use after free. Return after the fcexchrelease() call to avoid use after free.

Affected Software

148 affected componentsFixes available

ubuntu/linux-azure<4.15.0-1146.161~14.04.1

4.15.0-1146.161~14.04.1

ubuntu/linux<3.13.0-220.271

3.13.0-220.271

ubuntu/linux-aws<4.4.0-1160.166

4.4.0-1160.166

ubuntu/linux-lts-xenial<4.4.0-289.323~14.04.1

4.4.0-289.323~14.04.1

ubuntu/linux-aws-hwe<4.15.0-1137.148~16.04.1

4.15.0-1137.148~16.04.1

ubuntu/linux-azure<4.15.0-1146.161~16.04.1

4.15.0-1146.161~16.04.1

ubuntu/linux-gcp<4.15.0-1131.147~16.04.1

4.15.0-1131.147~16.04.1

ubuntu/linux-hwe<4.15.0-189.200~16.04.1

4.15.0-189.200~16.04.1

ubuntu/linux-oracle<4.15.0-1102.113~16.04.1

4.15.0-1102.113~16.04.1

ubuntu/linux<4.4.0-289.323

4.4.0-289.323

ubuntu/linux-aws<4.4.0-1198.213

4.4.0-1198.213

ubuntu/linux-hwe-edge*

ubuntu/linux-kvm<4.4.0-1161.172

4.4.0-1161.172

ubuntu/linux-fips<4.4.0-1130.137

4.4.0-1130.137

ubuntu/linux-fips*

ubuntu/linux<4.15.0-189.200

4.15.0-189.200

ubuntu/linux-aws<4.15.0-1137.148

4.15.0-1137.148

ubuntu/linux-aws-5.4<5.4.0-1078.84~18.04.1

5.4.0-1078.84~18.04.1

ubuntu/linux-azure-4.15<4.15.0-1146.161

4.15.0-1146.161

ubuntu/linux-azure-5.4<5.4.0-1083.87~18.04.1

5.4.0-1083.87~18.04.1

ubuntu/linux-gcp-4.15<4.15.0-1131.147

4.15.0-1131.147

ubuntu/linux-gcp-5.4<5.4.0-1078.84~18.04.1

5.4.0-1078.84~18.04.1

ubuntu/linux-hwe-5.4<5.4.0-117.132~18.04.1

5.4.0-117.132~18.04.1

ubuntu/linux-ibm-5.4<5.4.0-1028.32~18.04.1

5.4.0-1028.32~18.04.1

ubuntu/linux-kvm<4.15.0-1123.128

4.15.0-1123.128

ubuntu/linux-oracle<4.15.0-1102.113

4.15.0-1102.113

ubuntu/linux-oracle-5.4<5.4.0-1076.83~18.04.1

5.4.0-1076.83~18.04.1

ubuntu/linux-raspi-5.4<5.4.0-1065.75~18.04.1

5.4.0-1065.75~18.04.1

ubuntu/linux-aws-5.0*

ubuntu/linux-aws-5.3*

ubuntu/linux-azure*

ubuntu/linux-azure-5.3*

ubuntu/linux-azure-edge*

ubuntu/linux-gcp*

ubuntu/linux-gcp-5.3*

ubuntu/linux-gke-4.15*

ubuntu/linux-gke-5.4*

ubuntu/linux-gkeop-5.4*

ubuntu/linux-hwe*

ubuntu/linux-hwe-edge*

ubuntu/linux-oem*

ubuntu/linux-oracle-5.0*

ubuntu/linux-oracle-5.3*

ubuntu/linux-aws-fips<4.15.0-2076.81

4.15.0-2076.81

ubuntu/linux-azure-fips<4.15.0-2057.63

4.15.0-2057.63

ubuntu/linux-fips<4.15.0-1094.105

4.15.0-1094.105

ubuntu/linux-gcp-fips<4.15.0-2041.46

4.15.0-2041.46

ubuntu/linux-aws-fips*

ubuntu/linux-azure-fips*

ubuntu/linux-fips*

ubuntu/linux-gcp-fips*

ubuntu/linux<5.4.0-117.132

5.4.0-117.132

ubuntu/linux-aws<5.4.0-1078.84

5.4.0-1078.84

ubuntu/linux-azure<5.4.0-1083.87

5.4.0-1083.87

ubuntu/linux-azure-5.15<5.15.0-1008.9~20.04.1

5.15.0-1008.9~20.04.1

ubuntu/linux-bluefield<5.4.0-1040.44

5.4.0-1040.44

ubuntu/linux-gcp<5.4.0-1078.84

5.4.0-1078.84

ubuntu/linux-hwe-5.15<5.15.0-41.44~20.04.1

5.15.0-41.44~20.04.1

ubuntu/linux-ibm<5.4.0-1026.29

5.4.0-1026.29

ubuntu/linux-intel-iotg-5.15<5.15.0-1008.11~20.04.1

5.15.0-1008.11~20.04.1

ubuntu/linux-iot<5.4.0-1004.6

5.4.0-1004.6

ubuntu/linux-kvm<5.4.0-1068.72

5.4.0-1068.72

ubuntu/linux-lowlatency-hwe-5.15<5.15.0-42.45~20.04.1

5.15.0-42.45~20.04.1

ubuntu/linux-oracle<5.4.0-1076.83

5.4.0-1076.83

ubuntu/linux-raspi<5.4.0-1065.75

5.4.0-1065.75

ubuntu/linux-aws-5.11*

ubuntu/linux-aws-5.13*

ubuntu/linux-aws-5.8*

ubuntu/linux-azure-5.11*

ubuntu/linux-azure-5.13*

ubuntu/linux-azure-5.8*

ubuntu/linux-azure-fde*

ubuntu/linux-gcp-5.11*

ubuntu/linux-gcp-5.13*

ubuntu/linux-gcp-5.8*

ubuntu/linux-gke*

ubuntu/linux-gke-5.15*

ubuntu/linux-gkeop*

ubuntu/linux-gkeop-5.15*

ubuntu/linux-hwe-5.11*

ubuntu/linux-hwe-5.13*

ubuntu/linux-hwe-5.8*

ubuntu/linux-intel-5.13*

ubuntu/linux-oem-5.10*

ubuntu/linux-oem-5.13*

ubuntu/linux-oem-5.6*

ubuntu/linux-oracle-5.11*

ubuntu/linux-oracle-5.13*

ubuntu/linux-oracle-5.8*

ubuntu/linux-raspi2*

ubuntu/linux-riscv*

ubuntu/linux-riscv-5.11*

ubuntu/linux-riscv-5.8*

ubuntu/linux-aws-fips<5.4.0-1078.84+fips1

5.4.0-1078.84+fips1

ubuntu/linux-azure-fips<5.4.0-1083.87+fips1

5.4.0-1083.87+fips1

ubuntu/linux-fips<5.4.0-1054.61

5.4.0-1054.61

ubuntu/linux-gcp-fips<5.4.0-1078.84+fips1

5.4.0-1078.84+fips1

ubuntu/linux-aws-fips*

ubuntu/linux-azure-fips*

ubuntu/linux-fips*

ubuntu/linux-gcp-fips*

ubuntu/linux<5.15.0-37.39

5.15.0-37.39

ubuntu/linux-allwinner-5.19*

ubuntu/linux-aws<5.15.0-1011.14

5.15.0-1011.14

ubuntu/linux-aws-5.19*

ubuntu/linux-aws-6.2*

ubuntu/linux-aws-6.5*

ubuntu/linux-azure<5.15.0-1010.12

5.15.0-1010.12

ubuntu/linux-azure-5.19*

ubuntu/linux-azure-6.2*

ubuntu/linux-azure-6.5*

ubuntu/linux-azure-fde-5.19*

ubuntu/linux-azure-fde-6.2*

ubuntu/linux-gcp<5.15.0-1008.12

5.15.0-1008.12

ubuntu/linux-gcp-5.19*

ubuntu/linux-gcp-6.2*

ubuntu/linux-gcp-6.5*

ubuntu/linux-gke<5.15.0-1008.10

5.15.0-1008.10

ubuntu/linux-hwe-5.19*

ubuntu/linux-hwe-6.2*

ubuntu/linux-hwe-6.5*

ubuntu/linux-ibm<5.15.0-1007.8

5.15.0-1007.8

ubuntu/linux-intel-iot-realtime*

ubuntu/linux-intel-iotg<5.15.0-1008.11

5.15.0-1008.11

ubuntu/linux-kvm<5.15.0-1010.11

5.15.0-1010.11

ubuntu/linux-lowlatency<5.15.0-37.39

5.15.0-37.39

ubuntu/linux-lowlatency-hwe-5.19*

ubuntu/linux-lowlatency-hwe-6.2*

ubuntu/linux-lowlatency-hwe-6.5*

ubuntu/linux-nvidia-6.2*

ubuntu/linux-nvidia-6.5*

ubuntu/linux-oem-5.17*

ubuntu/linux-oem-6.0*

ubuntu/linux-oem-6.1*

ubuntu/linux-oem-6.5*

ubuntu/linux-oracle<5.15.0-1009.12

5.15.0-1009.12

ubuntu/linux-oracle-6.5*

ubuntu/linux-raspi<5.15.0-1011.13

5.15.0-1011.13

ubuntu/linux-realtime*

ubuntu/linux-riscv*

ubuntu/linux-riscv-5.19*

ubuntu/linux-riscv-6.5*

ubuntu/linux-starfive-5.19*

ubuntu/linux-starfive-6.2*

ubuntu/linux-starfive-6.5*

ubuntu/linux-realtime<5.15.0-1014.14

5.15.0-1014.14

ubuntu/linux-raspi-realtime*

ubuntu/linux-vmware*

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade ubuntu/linux-azure to a version that resolves this vulnerability.
Fixed in 4.15.0-1146.161~14.04.1
Upgrade
Upgrade ubuntu/linux to a version that resolves this vulnerability.
Fixed in 3.13.0-220.271
Upgrade
Upgrade ubuntu/linux-aws to a version that resolves this vulnerability.
Fixed in 4.4.0-1160.166
Upgrade
Upgrade ubuntu/linux-lts-xenial to a version that resolves this vulnerability.
Fixed in 4.4.0-289.323~14.04.1
Upgrade
Upgrade ubuntu/linux-aws-hwe to a version that resolves this vulnerability.
Fixed in 4.15.0-1137.148~16.04.1
Upgrade
Upgrade ubuntu/linux-azure to a version that resolves this vulnerability.
Fixed in 4.15.0-1146.161~16.04.1
Upgrade
Upgrade ubuntu/linux-gcp to a version that resolves this vulnerability.
Fixed in 4.15.0-1131.147~16.04.1
Upgrade
Upgrade ubuntu/linux-hwe to a version that resolves this vulnerability.
Fixed in 4.15.0-189.200~16.04.1
Upgrade
Upgrade ubuntu/linux-oracle to a version that resolves this vulnerability.
Fixed in 4.15.0-1102.113~16.04.1
Upgrade
Upgrade ubuntu/linux to a version that resolves this vulnerability.
Fixed in 4.4.0-289.323
Upgrade
Upgrade ubuntu/linux-aws to a version that resolves this vulnerability.
Fixed in 4.4.0-1198.213
Upgrade
Upgrade ubuntu/linux-kvm to a version that resolves this vulnerability.
Fixed in 4.4.0-1161.172
Upgrade
Upgrade ubuntu/linux-fips to a version that resolves this vulnerability.
Fixed in 4.4.0-1130.137
Upgrade
Upgrade ubuntu/linux to a version that resolves this vulnerability.
Fixed in 4.15.0-189.200
Upgrade
Upgrade ubuntu/linux-aws to a version that resolves this vulnerability.
Fixed in 4.15.0-1137.148
Upgrade
Upgrade ubuntu/linux-aws-5.4 to a version that resolves this vulnerability.
Fixed in 5.4.0-1078.84~18.04.1
Upgrade
Upgrade ubuntu/linux-azure-4.15 to a version that resolves this vulnerability.
Fixed in 4.15.0-1146.161
Upgrade
Upgrade ubuntu/linux-azure-5.4 to a version that resolves this vulnerability.
Fixed in 5.4.0-1083.87~18.04.1
Upgrade
Upgrade ubuntu/linux-gcp-4.15 to a version that resolves this vulnerability.
Fixed in 4.15.0-1131.147
Upgrade
Upgrade ubuntu/linux-gcp-5.4 to a version that resolves this vulnerability.
Fixed in 5.4.0-1078.84~18.04.1
Upgrade
Upgrade ubuntu/linux-hwe-5.4 to a version that resolves this vulnerability.
Fixed in 5.4.0-117.132~18.04.1
Upgrade
Upgrade ubuntu/linux-ibm-5.4 to a version that resolves this vulnerability.
Fixed in 5.4.0-1028.32~18.04.1
Upgrade
Upgrade ubuntu/linux-kvm to a version that resolves this vulnerability.
Fixed in 4.15.0-1123.128
Upgrade
Upgrade ubuntu/linux-oracle to a version that resolves this vulnerability.
Fixed in 4.15.0-1102.113
Upgrade
Upgrade ubuntu/linux-oracle-5.4 to a version that resolves this vulnerability.
Fixed in 5.4.0-1076.83~18.04.1
Upgrade
Upgrade ubuntu/linux-raspi-5.4 to a version that resolves this vulnerability.
Fixed in 5.4.0-1065.75~18.04.1
Upgrade
Upgrade ubuntu/linux-aws-fips to a version that resolves this vulnerability.
Fixed in 4.15.0-2076.81
Upgrade
Upgrade ubuntu/linux-azure-fips to a version that resolves this vulnerability.
Fixed in 4.15.0-2057.63
Upgrade
Upgrade ubuntu/linux-fips to a version that resolves this vulnerability.
Fixed in 4.15.0-1094.105
Upgrade
Upgrade ubuntu/linux-gcp-fips to a version that resolves this vulnerability.
Fixed in 4.15.0-2041.46
Upgrade
Upgrade ubuntu/linux to a version that resolves this vulnerability.
Fixed in 5.4.0-117.132
Upgrade
Upgrade ubuntu/linux-aws to a version that resolves this vulnerability.
Fixed in 5.4.0-1078.84
Upgrade
Upgrade ubuntu/linux-azure to a version that resolves this vulnerability.
Fixed in 5.4.0-1083.87
Upgrade
Upgrade ubuntu/linux-azure-5.15 to a version that resolves this vulnerability.
Fixed in 5.15.0-1008.9~20.04.1
Upgrade
Upgrade ubuntu/linux-bluefield to a version that resolves this vulnerability.
Fixed in 5.4.0-1040.44
Upgrade
Upgrade ubuntu/linux-gcp to a version that resolves this vulnerability.
Fixed in 5.4.0-1078.84
Upgrade
Upgrade ubuntu/linux-hwe-5.15 to a version that resolves this vulnerability.
Fixed in 5.15.0-41.44~20.04.1
Upgrade
Upgrade ubuntu/linux-ibm to a version that resolves this vulnerability.
Fixed in 5.4.0-1026.29
Upgrade
Upgrade ubuntu/linux-intel-iotg-5.15 to a version that resolves this vulnerability.
Fixed in 5.15.0-1008.11~20.04.1
Upgrade
Upgrade ubuntu/linux-iot to a version that resolves this vulnerability.
Fixed in 5.4.0-1004.6
Upgrade
Upgrade ubuntu/linux-kvm to a version that resolves this vulnerability.
Fixed in 5.4.0-1068.72
Upgrade
Upgrade ubuntu/linux-lowlatency-hwe-5.15 to a version that resolves this vulnerability.
Fixed in 5.15.0-42.45~20.04.1
Upgrade
Upgrade ubuntu/linux-oracle to a version that resolves this vulnerability.
Fixed in 5.4.0-1076.83
Upgrade
Upgrade ubuntu/linux-raspi to a version that resolves this vulnerability.
Fixed in 5.4.0-1065.75
Upgrade
Upgrade ubuntu/linux-aws-fips to a version that resolves this vulnerability.
Fixed in 5.4.0-1078.84+fips1
Upgrade
Upgrade ubuntu/linux-azure-fips to a version that resolves this vulnerability.
Fixed in 5.4.0-1083.87+fips1
Upgrade
Upgrade ubuntu/linux-fips to a version that resolves this vulnerability.
Fixed in 5.4.0-1054.61
Upgrade
Upgrade ubuntu/linux-gcp-fips to a version that resolves this vulnerability.
Fixed in 5.4.0-1078.84+fips1
Upgrade
Upgrade ubuntu/linux to a version that resolves this vulnerability.
Fixed in 5.15.0-37.39
Upgrade
Upgrade ubuntu/linux-aws to a version that resolves this vulnerability.
Fixed in 5.15.0-1011.14
Upgrade
Upgrade ubuntu/linux-azure to a version that resolves this vulnerability.
Fixed in 5.15.0-1010.12
Upgrade
Upgrade ubuntu/linux-gcp to a version that resolves this vulnerability.
Fixed in 5.15.0-1008.12
Upgrade
Upgrade ubuntu/linux-gke to a version that resolves this vulnerability.
Fixed in 5.15.0-1008.10
Upgrade
Upgrade ubuntu/linux-ibm to a version that resolves this vulnerability.
Fixed in 5.15.0-1007.8
Upgrade
Upgrade ubuntu/linux-intel-iotg to a version that resolves this vulnerability.
Fixed in 5.15.0-1008.11
Upgrade
Upgrade ubuntu/linux-kvm to a version that resolves this vulnerability.
Fixed in 5.15.0-1010.11
Upgrade
Upgrade ubuntu/linux-lowlatency to a version that resolves this vulnerability.
Fixed in 5.15.0-37.39
Upgrade
Upgrade ubuntu/linux-oracle to a version that resolves this vulnerability.
Fixed in 5.15.0-1009.12
Upgrade
Upgrade ubuntu/linux-raspi to a version that resolves this vulnerability.
Fixed in 5.15.0-1011.13
Upgrade
Upgrade ubuntu/linux-realtime to a version that resolves this vulnerability.
Fixed in 5.15.0-1014.14

Event History

Feb 26, 2025

CVE Published

via OSV·07:00 AM

Data Sourced

via OSV·07:00 AM

DescriptionSeverityAffected Software

Frequently Asked Questions

Which Ubuntu kernel package variants are identified as affected?

The listed packages are ubuntu/linux-fips, ubuntu/linux-azure, ubuntu/linux, ubuntu/linux-aws, ubuntu/linux-gcp, ubuntu/linux-oracle, ubuntu/linux-kvm, and ubuntu/linux-aws-fips.

Does exploitation require credentials or user interaction?

The supplied vector indicates no privileges are required and no user interaction is required. It identifies adjacent-network attack access and low attack complexity, with attack requirements present.

What impact is indicated if exploitation succeeds?

The vector rates confidentiality, integrity, and availability impact as high for the vulnerable system. It indicates no impact on a subsequent system.

Are fixed package versions provided?

No fixed Ubuntu package versions are included in the provided information.

UBUNTU-CVE-2022-49114: Use After Free

Affected Software

Remediation

Event History

Frequently Asked Questions

Which Ubuntu kernel package variants are identified as affected?

Does exploitation require credentials or user interaction?

What impact is indicated if exploitation succeeds?

Are fixed package versions provided?

Company

Resources

Contact

Frequently Asked Questions

Which Ubuntu kernel package variants are identified as affected?

Does exploitation require credentials or user interaction?

What impact is indicated if exploitation succeeds?

Are fixed package versions provided?