UBUNTU-CVE-2022-49179: Use After Free

Q: Which Ubuntu kernel packages are in scope?

The affected software list includes ubuntu/linux, ubuntu/linux-azure, ubuntu/linux-gcp, ubuntu/linux-oracle, ubuntu/linux-fips, ubuntu/linux-aws-fips, ubuntu/linux-azure-fips, and ubuntu/linux-gcp-fips.

Q: What level of access does an attacker need?

The severity vector indicates local access and low privileges are required. No user interaction is required.

Q: What could exploitation affect?

The severity vector rates confidentiality, integrity, and availability impact as high.

Q: What evidence could indicate the issue has occurred?

The reported failure is a KASAN use-after-free in __bfq_put_async_bfqq, with related stack frames including bfq_put_async_queues, bfq_pd_offline, bfq_exit_queue, and elevator_exit. The supplied report occurred while the rmmod process was running.

Published Feb 26, 2025

Updated

In the Linux kernel, the following vulnerability has been resolved: block, bfq: don't move oombfqq Our test report a UAF: [ 2073.019181] ================================================================== [ 2073.019188] BUG: KASAN: use-after-free in bfqputasyncbfqq+0xa0/0x168 [ 2073.019191] Write of size 8 at addr ffff8000ccf64128 by task rmmod/72584 [ 2073.019192] [ 2073.019196] CPU: 0 PID: 72584 Comm: rmmod Kdump: loaded Not tainted 4.19.90-yk #5 [ 2073.019198] Hardware name: QEMU KVM Virtual Machine, BIOS 0.0.0 02/06/2015 [ 2073.019200] Call trace: [ 2073.019203] dumpbacktrace+0x0/0x310 [ 2073.019206] showstack+0x28/0x38 [ 2073.019210] dumpstack+0xec/0x15c [ 2073.019216] printaddressdescription+0x68/0x2d0 [ 2073.019220] kasanreport+0x238/0x2f0 [ 2073.019224] asanstore8+0x88/0xb0 [ 2073.019229] bfqputasyncbfqq+0xa0/0x168 [ 2073.019233] bfqputasyncqueues+0xbc/0x208 [ 2073.019236] bfqpdoffline+0x178/0x238 [ 2073.019240] blkcgdeactivatepolicy+0x1f0/0x420 [ 2073.019244] bfqexitqueue+0x128/0x178 [ 2073.019249] blkmqexitsched+0x12c/0x160 [ 2073.019252] elevatorexit+0xc8/0xd0 [ 2073.019256] blkexitqueue+0x50/0x88 [ 2073.019259] blkcleanupqueue+0x228/0x3d8 [ 2073.019267] nulldeldev+0xfc/0x1e0 [nullblk] [ 2073.019274] nullexit+0x90/0x114 [nullblk] [ 2073.019278] arm64sysdeletemodule+0x358/0x5a0 [ 2073.019282] el0svccommon+0xc8/0x320 [ 2073.019287] el0svchandler+0xf8/0x160 [ 2073.019290] el0svc+0x10/0x218 [ 2073.019291] [ 2073.019294] Allocated by task 14163: [ 2073.019301] kasankmalloc+0xe0/0x190 [ 2073.019305] kmemcacheallocnodetrace+0x1cc/0x418 [ 2073.019308] bfqpdalloc+0x54/0x118 [ 2073.019313] blkcgactivatepolicy+0x250/0x460 [ 2073.019317] bfqcreategrouphierarchy+0x38/0x110 [ 2073.019321] bfqinitqueue+0x6d0/0x948 [ 2073.019325] blkmqinitsched+0x1d8/0x390 [ 2073.019330] elevatorswitchmq+0x88/0x170 [ 2073.019334] elevatorswitch+0x140/0x270 [ 2073.019338] elvioschedstore+0x1a4/0x2a0 [ 2073.019342] queueattrstore+0x90/0xe0 [ 2073.019348] sysfskfwrite+0xa8/0xe8 [ 2073.019351] kernfsfopwrite+0x1f8/0x378 [ 2073.019359] vfswrite+0xe0/0x360 [ 2073.019363] vfswrite+0xf0/0x270 [ 2073.019367] ksyswrite+0xdc/0x1b8 [ 2073.019371] arm64syswrite+0x50/0x60 [ 2073.019375] el0svccommon+0xc8/0x320 [ 2073.019380] el0svchandler+0xf8/0x160 [ 2073.019383] el0svc+0x10/0x218 [ 2073.019385] [ 2073.019387] Freed by task 72584: [ 2073.019391] kasanslabfree+0x120/0x228 [ 2073.019394] kasanslabfree+0x10/0x18 [ 2073.019397] kfree+0x94/0x368 [ 2073.019400] bfqgput+0x64/0xb0 [ 2073.019404] bfqgandblkgput+0x90/0xb0 [ 2073.019408] bfqputqueue+0x220/0x228 [ 2073.019413] bfqputasyncbfqq+0x98/0x168 [ 2073.019416] bfqputasyncqueues+0xbc/0x208 [ 2073.019420] bfqpdoffline+0x178/0x238 [ 2073.019424] blkcgdeactivatepolicy+0x1f0/0x420 [ 2073.019429] bfqexitqueue+0x128/0x178 [ 2073.019433] blkmqexitsched+0x12c/0x160 [ 2073.019437] elevatorexit+0xc8/0xd0 [ 2073.019440] blkexitqueue+0x50/0x88 [ 2073.019443] blkcleanupqueue+0x228/0x3d8 [ 2073.019451] nulldeldev+0xfc/0x1e0 [nullblk] [ 2073.019459] nullexit+0x90/0x114 [nullblk] [ 2073.019462] arm64sysdeletemodule+0x358/0x5a0 [ 2073.019467] el0svccommon+0xc8/0x320 [ 2073.019471] el0svchandler+0xf8/0x160 [ 2073.019474] el0svc+0x10/0x218 [ 2073.019475] [ 2073.019479] The buggy address belongs to the object at ffff8000ccf63f00 which belongs to the cache kmalloc-1024 of size 1024 [ 2073.019484] The buggy address is located 552 bytes inside of 1024-byte region [ffff8000ccf63f00, ffff8000ccf64300) [ 2073.019486] The buggy address belongs to the page: [ 2073.019492] page:ffff7e000333d800 count:1 mapcount:0 mapping:ffff8000c0003a00 index:0x0 compoundmapcount: 0 [ 2073.020123] flags: 0x7ffff0000008100(slab|head) [ 2073.020403] raw: 07ffff0000008100 ffff7e0003334c08 ffff7e00001f5a08 ffff8000c0003a00 [ 2073.020409] ra ---truncated---

Affected Software

140 affected componentsFixes available

ubuntu/linux-azure<4.15.0-1190.205~14.04.1

4.15.0-1190.205~14.04.1

ubuntu/linux-aws-hwe<4.15.0-1182.195~16.04.1

4.15.0-1182.195~16.04.1

ubuntu/linux-azure<4.15.0-1190.205~16.04.1

4.15.0-1190.205~16.04.1

ubuntu/linux-gcp<4.15.0-1175.192~16.04.1

4.15.0-1175.192~16.04.1

ubuntu/linux-hwe<4.15.0-239.251~16.04.1

4.15.0-239.251~16.04.1

ubuntu/linux-oracle<4.15.0-1144.155~16.04.1

4.15.0-1144.155~16.04.1

ubuntu/linux-hwe-edge*

ubuntu/linux-aws-5.4<5.4.0-1078.84~18.04.1

5.4.0-1078.84~18.04.1

ubuntu/linux-azure-5.4<5.4.0-1083.87~18.04.1

5.4.0-1083.87~18.04.1

ubuntu/linux-gcp-5.4<5.4.0-1078.84~18.04.1

5.4.0-1078.84~18.04.1

ubuntu/linux-hwe-5.4<5.4.0-117.132~18.04.1

5.4.0-117.132~18.04.1

ubuntu/linux-ibm-5.4<5.4.0-1028.32~18.04.1

5.4.0-1028.32~18.04.1

ubuntu/linux-oracle-5.4<5.4.0-1076.83~18.04.1

5.4.0-1076.83~18.04.1

ubuntu/linux-raspi-5.4<5.4.0-1065.75~18.04.1

5.4.0-1065.75~18.04.1

ubuntu/linux<4.15.0-239.251

4.15.0-239.251

ubuntu/linux-aws<4.15.0-1182.195

4.15.0-1182.195

ubuntu/linux-aws-5.0*

ubuntu/linux-aws-5.3*

ubuntu/linux-azure*

ubuntu/linux-azure-4.15<4.15.0-1190.205

4.15.0-1190.205

ubuntu/linux-azure-5.3*

ubuntu/linux-azure-edge*

ubuntu/linux-gcp*

ubuntu/linux-gcp-4.15<4.15.0-1175.192

4.15.0-1175.192

ubuntu/linux-gcp-5.3*

ubuntu/linux-gke-4.15*

ubuntu/linux-gke-5.4*

ubuntu/linux-gkeop-5.4*

ubuntu/linux-hwe*

ubuntu/linux-hwe-edge*

ubuntu/linux-kvm<4.15.0-1165.170

4.15.0-1165.170

ubuntu/linux-oem*

ubuntu/linux-oracle<4.15.0-1144.155

4.15.0-1144.155

ubuntu/linux-oracle-5.0*

ubuntu/linux-oracle-5.3*

ubuntu/linux-aws-fips<4.15.0-2120.126

4.15.0-2120.126

ubuntu/linux-azure-fips<4.15.0-2099.105

4.15.0-2099.105

ubuntu/linux-fips<4.15.0-1137.148

4.15.0-1137.148

ubuntu/linux-gcp-fips<4.15.0-2083.89

4.15.0-2083.89

ubuntu/linux-aws-fips*

ubuntu/linux-azure-fips*

ubuntu/linux-fips*

ubuntu/linux-gcp-fips*

ubuntu/linux<5.4.0-117.132

5.4.0-117.132

ubuntu/linux-aws<5.4.0-1078.84

5.4.0-1078.84

ubuntu/linux-azure<5.4.0-1083.87

5.4.0-1083.87

ubuntu/linux-azure-5.15<5.15.0-1008.9~20.04.1

5.15.0-1008.9~20.04.1

ubuntu/linux-bluefield<5.4.0-1040.44

5.4.0-1040.44

ubuntu/linux-gcp<5.4.0-1078.84

5.4.0-1078.84

ubuntu/linux-hwe-5.15<5.15.0-41.44~20.04.1

5.15.0-41.44~20.04.1

ubuntu/linux-ibm<5.4.0-1026.29

5.4.0-1026.29

ubuntu/linux-intel-iotg-5.15<5.15.0-1008.11~20.04.1

5.15.0-1008.11~20.04.1

ubuntu/linux-iot<5.4.0-1004.6

5.4.0-1004.6

ubuntu/linux-kvm<5.4.0-1068.72

5.4.0-1068.72

ubuntu/linux-lowlatency-hwe-5.15<5.15.0-42.45~20.04.1

5.15.0-42.45~20.04.1

ubuntu/linux-oracle<5.4.0-1076.83

5.4.0-1076.83

ubuntu/linux-raspi<5.4.0-1065.75

5.4.0-1065.75

ubuntu/linux-aws-5.11*

ubuntu/linux-aws-5.13*

ubuntu/linux-aws-5.8*

ubuntu/linux-azure-5.11*

ubuntu/linux-azure-5.13*

ubuntu/linux-azure-5.8*

ubuntu/linux-azure-fde*

ubuntu/linux-gcp-5.11*

ubuntu/linux-gcp-5.13*

ubuntu/linux-gcp-5.8*

ubuntu/linux-gke*

ubuntu/linux-gke-5.15*

ubuntu/linux-gkeop*

ubuntu/linux-gkeop-5.15*

ubuntu/linux-hwe-5.11*

ubuntu/linux-hwe-5.13*

ubuntu/linux-hwe-5.8*

ubuntu/linux-intel-5.13*

ubuntu/linux-oem-5.10*

ubuntu/linux-oem-5.13*

ubuntu/linux-oem-5.6*

ubuntu/linux-oracle-5.11*

ubuntu/linux-oracle-5.13*

ubuntu/linux-oracle-5.8*

ubuntu/linux-raspi2*

ubuntu/linux-riscv*

ubuntu/linux-riscv-5.11*

ubuntu/linux-riscv-5.8*

ubuntu/linux-aws-fips<5.4.0-1078.84+fips1

5.4.0-1078.84+fips1

ubuntu/linux-azure-fips<5.4.0-1083.87+fips1

5.4.0-1083.87+fips1

ubuntu/linux-fips<5.4.0-1054.61

5.4.0-1054.61

ubuntu/linux-gcp-fips<5.4.0-1078.84+fips1

5.4.0-1078.84+fips1

ubuntu/linux-aws-fips*

ubuntu/linux-azure-fips*

ubuntu/linux-fips*

ubuntu/linux-gcp-fips*

ubuntu/linux<5.15.0-37.39

5.15.0-37.39

ubuntu/linux-allwinner-5.19*

ubuntu/linux-aws<5.15.0-1011.14

5.15.0-1011.14

ubuntu/linux-aws-5.19*

ubuntu/linux-aws-6.2*

ubuntu/linux-aws-6.5*

ubuntu/linux-azure<5.15.0-1010.12

5.15.0-1010.12

ubuntu/linux-azure-5.19*

ubuntu/linux-azure-6.2*

ubuntu/linux-azure-6.5*

ubuntu/linux-azure-fde-5.19*

ubuntu/linux-azure-fde-6.2*

ubuntu/linux-gcp<5.15.0-1008.12

5.15.0-1008.12

ubuntu/linux-gcp-5.19*

ubuntu/linux-gcp-6.2*

ubuntu/linux-gcp-6.5*

ubuntu/linux-gke<5.15.0-1008.10

5.15.0-1008.10

ubuntu/linux-hwe-5.19*

ubuntu/linux-hwe-6.2*

ubuntu/linux-hwe-6.5*

ubuntu/linux-ibm<5.15.0-1007.8

5.15.0-1007.8

ubuntu/linux-intel-iot-realtime*

ubuntu/linux-intel-iotg<5.15.0-1008.11

5.15.0-1008.11

ubuntu/linux-kvm<5.15.0-1010.11

5.15.0-1010.11

ubuntu/linux-lowlatency<5.15.0-37.39

5.15.0-37.39

ubuntu/linux-lowlatency-hwe-5.19*

ubuntu/linux-lowlatency-hwe-6.2*

ubuntu/linux-lowlatency-hwe-6.5*

ubuntu/linux-nvidia-6.2*

ubuntu/linux-nvidia-6.5*

ubuntu/linux-oem-5.17*

ubuntu/linux-oem-6.0*

ubuntu/linux-oem-6.1*

ubuntu/linux-oem-6.5*

ubuntu/linux-oracle<5.15.0-1009.12

5.15.0-1009.12

ubuntu/linux-oracle-6.5*

ubuntu/linux-raspi<5.15.0-1011.13

5.15.0-1011.13

ubuntu/linux-realtime*

ubuntu/linux-riscv*

ubuntu/linux-riscv-5.19*

ubuntu/linux-riscv-6.5*

ubuntu/linux-starfive-5.19*

ubuntu/linux-starfive-6.2*

ubuntu/linux-starfive-6.5*

ubuntu/linux-realtime<5.15.0-1014.14

5.15.0-1014.14

ubuntu/linux-raspi-realtime*

ubuntu/linux-vmware*

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade ubuntu/linux-azure to a version that resolves this vulnerability.
Fixed in 4.15.0-1190.205~14.04.1
Upgrade
Upgrade ubuntu/linux-aws-hwe to a version that resolves this vulnerability.
Fixed in 4.15.0-1182.195~16.04.1
Upgrade
Upgrade ubuntu/linux-azure to a version that resolves this vulnerability.
Fixed in 4.15.0-1190.205~16.04.1
Upgrade
Upgrade ubuntu/linux-gcp to a version that resolves this vulnerability.
Fixed in 4.15.0-1175.192~16.04.1
Upgrade
Upgrade ubuntu/linux-hwe to a version that resolves this vulnerability.
Fixed in 4.15.0-239.251~16.04.1
Upgrade
Upgrade ubuntu/linux-oracle to a version that resolves this vulnerability.
Fixed in 4.15.0-1144.155~16.04.1
Upgrade
Upgrade ubuntu/linux-aws-5.4 to a version that resolves this vulnerability.
Fixed in 5.4.0-1078.84~18.04.1
Upgrade
Upgrade ubuntu/linux-azure-5.4 to a version that resolves this vulnerability.
Fixed in 5.4.0-1083.87~18.04.1
Upgrade
Upgrade ubuntu/linux-gcp-5.4 to a version that resolves this vulnerability.
Fixed in 5.4.0-1078.84~18.04.1
Upgrade
Upgrade ubuntu/linux-hwe-5.4 to a version that resolves this vulnerability.
Fixed in 5.4.0-117.132~18.04.1
Upgrade
Upgrade ubuntu/linux-ibm-5.4 to a version that resolves this vulnerability.
Fixed in 5.4.0-1028.32~18.04.1
Upgrade
Upgrade ubuntu/linux-oracle-5.4 to a version that resolves this vulnerability.
Fixed in 5.4.0-1076.83~18.04.1
Upgrade
Upgrade ubuntu/linux-raspi-5.4 to a version that resolves this vulnerability.
Fixed in 5.4.0-1065.75~18.04.1
Upgrade
Upgrade ubuntu/linux to a version that resolves this vulnerability.
Fixed in 4.15.0-239.251
Upgrade
Upgrade ubuntu/linux-aws to a version that resolves this vulnerability.
Fixed in 4.15.0-1182.195
Upgrade
Upgrade ubuntu/linux-azure-4.15 to a version that resolves this vulnerability.
Fixed in 4.15.0-1190.205
Upgrade
Upgrade ubuntu/linux-gcp-4.15 to a version that resolves this vulnerability.
Fixed in 4.15.0-1175.192
Upgrade
Upgrade ubuntu/linux-kvm to a version that resolves this vulnerability.
Fixed in 4.15.0-1165.170
Upgrade
Upgrade ubuntu/linux-oracle to a version that resolves this vulnerability.
Fixed in 4.15.0-1144.155
Upgrade
Upgrade ubuntu/linux-aws-fips to a version that resolves this vulnerability.
Fixed in 4.15.0-2120.126
Upgrade
Upgrade ubuntu/linux-azure-fips to a version that resolves this vulnerability.
Fixed in 4.15.0-2099.105
Upgrade
Upgrade ubuntu/linux-fips to a version that resolves this vulnerability.
Fixed in 4.15.0-1137.148
Upgrade
Upgrade ubuntu/linux-gcp-fips to a version that resolves this vulnerability.
Fixed in 4.15.0-2083.89
Upgrade
Upgrade ubuntu/linux to a version that resolves this vulnerability.
Fixed in 5.4.0-117.132
Upgrade
Upgrade ubuntu/linux-aws to a version that resolves this vulnerability.
Fixed in 5.4.0-1078.84
Upgrade
Upgrade ubuntu/linux-azure to a version that resolves this vulnerability.
Fixed in 5.4.0-1083.87
Upgrade
Upgrade ubuntu/linux-azure-5.15 to a version that resolves this vulnerability.
Fixed in 5.15.0-1008.9~20.04.1
Upgrade
Upgrade ubuntu/linux-bluefield to a version that resolves this vulnerability.
Fixed in 5.4.0-1040.44
Upgrade
Upgrade ubuntu/linux-gcp to a version that resolves this vulnerability.
Fixed in 5.4.0-1078.84
Upgrade
Upgrade ubuntu/linux-hwe-5.15 to a version that resolves this vulnerability.
Fixed in 5.15.0-41.44~20.04.1
Upgrade
Upgrade ubuntu/linux-ibm to a version that resolves this vulnerability.
Fixed in 5.4.0-1026.29
Upgrade
Upgrade ubuntu/linux-intel-iotg-5.15 to a version that resolves this vulnerability.
Fixed in 5.15.0-1008.11~20.04.1
Upgrade
Upgrade ubuntu/linux-iot to a version that resolves this vulnerability.
Fixed in 5.4.0-1004.6
Upgrade
Upgrade ubuntu/linux-kvm to a version that resolves this vulnerability.
Fixed in 5.4.0-1068.72
Upgrade
Upgrade ubuntu/linux-lowlatency-hwe-5.15 to a version that resolves this vulnerability.
Fixed in 5.15.0-42.45~20.04.1
Upgrade
Upgrade ubuntu/linux-oracle to a version that resolves this vulnerability.
Fixed in 5.4.0-1076.83
Upgrade
Upgrade ubuntu/linux-raspi to a version that resolves this vulnerability.
Fixed in 5.4.0-1065.75
Upgrade
Upgrade ubuntu/linux-aws-fips to a version that resolves this vulnerability.
Fixed in 5.4.0-1078.84+fips1
Upgrade
Upgrade ubuntu/linux-azure-fips to a version that resolves this vulnerability.
Fixed in 5.4.0-1083.87+fips1
Upgrade
Upgrade ubuntu/linux-fips to a version that resolves this vulnerability.
Fixed in 5.4.0-1054.61
Upgrade
Upgrade ubuntu/linux-gcp-fips to a version that resolves this vulnerability.
Fixed in 5.4.0-1078.84+fips1
Upgrade
Upgrade ubuntu/linux to a version that resolves this vulnerability.
Fixed in 5.15.0-37.39
Upgrade
Upgrade ubuntu/linux-aws to a version that resolves this vulnerability.
Fixed in 5.15.0-1011.14
Upgrade
Upgrade ubuntu/linux-azure to a version that resolves this vulnerability.
Fixed in 5.15.0-1010.12
Upgrade
Upgrade ubuntu/linux-gcp to a version that resolves this vulnerability.
Fixed in 5.15.0-1008.12
Upgrade
Upgrade ubuntu/linux-gke to a version that resolves this vulnerability.
Fixed in 5.15.0-1008.10
Upgrade
Upgrade ubuntu/linux-ibm to a version that resolves this vulnerability.
Fixed in 5.15.0-1007.8
Upgrade
Upgrade ubuntu/linux-intel-iotg to a version that resolves this vulnerability.
Fixed in 5.15.0-1008.11
Upgrade
Upgrade ubuntu/linux-kvm to a version that resolves this vulnerability.
Fixed in 5.15.0-1010.11
Upgrade
Upgrade ubuntu/linux-lowlatency to a version that resolves this vulnerability.
Fixed in 5.15.0-37.39
Upgrade
Upgrade ubuntu/linux-oracle to a version that resolves this vulnerability.
Fixed in 5.15.0-1009.12
Upgrade
Upgrade ubuntu/linux-raspi to a version that resolves this vulnerability.
Fixed in 5.15.0-1011.13
Upgrade
Upgrade ubuntu/linux-realtime to a version that resolves this vulnerability.
Fixed in 5.15.0-1014.14
Compensating control
In BFQ code, do not move the oom_bfqq queue.

Event History

Feb 26, 2025

CVE Published

via OSV·07:00 AM

Data Sourced

via OSV·07:00 AM

DescriptionSeverityAffected Software

Frequently Asked Questions

Which Ubuntu kernel packages are in scope?

The affected software list includes ubuntu/linux, ubuntu/linux-azure, ubuntu/linux-gcp, ubuntu/linux-oracle, ubuntu/linux-fips, ubuntu/linux-aws-fips, ubuntu/linux-azure-fips, and ubuntu/linux-gcp-fips.

What level of access does an attacker need?

The severity vector indicates local access and low privileges are required. No user interaction is required.

What could exploitation affect?

The severity vector rates confidentiality, integrity, and availability impact as high.

What evidence could indicate the issue has occurred?

The reported failure is a KASAN use-after-free in __bfq_put_async_bfqq, with related stack frames including bfq_put_async_queues, bfq_pd_offline, bfq_exit_queue, and elevator_exit. The supplied report occurred while the rmmod process was running.

UBUNTU-CVE-2022-49179: Use After Free

Affected Software

Remediation

Event History

Frequently Asked Questions

Which Ubuntu kernel packages are in scope?

What level of access does an attacker need?

What could exploitation affect?

What evidence could indicate the issue has occurred?

Company

Resources

Contact

Frequently Asked Questions

Which Ubuntu kernel packages are in scope?

What level of access does an attacker need?

What could exploitation affect?

What evidence could indicate the issue has occurred?