Critical Use-After-Free Vulnerability in Linux Kernel - CVE-2022-49377
Summary
CVE-2022-49377: In the Linux kernel, the following vulnerability has been resolved: blk-mq: don't touch ->tagset in blk_mq_get_sq_hctx blk_mq_run_hw_queues() could be run when there isn't queued request and after queue is cleaned up, at... Affects linux versions < 5.18.5-1. Fixed in 5.18.5-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The Linux kernel is the core component of many operating systems, providing essential services for hardware and software interactions. It is known for its stability, performance, and security features. However, like any complex software, it can have vulnerabilities. CVE-2022-49377 is a significant issue affecting the Linux kernel, specifically in the blk-mq subsystem, which manages block device I/O scheduling. This vulnerability can lead to severe consequences if exploited, including system crashes or unauthorized access.
Vulnerability Detail
CVE-2022-49377 is a use-after-free vulnerability in the Linux kernel's blk-mq subsystem. It occurs when the blk_mq_run_hw_queues() function is executed without any queued requests, leading to the cleanup of the request queue. At this point, the tagset associated with the queue may be freed, resulting in a use-after-free condition. This can potentially allow an attacker to execute arbitrary code or cause a denial of service by manipulating memory that has already been freed. The vulnerability arises from improper handling of the tagset's lifecycle, which is managed by the driver and often freed after the blk_cleanup_queue() function returns.
How To Fix
Minimum fixed version
5.18.5-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. The best course of action is to apply the available patch by updating to the fixed version of the Linux kernel.
Conclusion
CVE-2022-49377 is a critical vulnerability in the Linux kernel that requires immediate attention. Updating to the fixed version is essential to protect your system from potential exploitation. Utilize tools like Vulert to stay informed about vulnerabilities in your software.
See every vulnerability recorded for linux →
FAQ
CVE-2022-49377 is a use-after-free vulnerability in the Linux kernel's blk-mq subsystem that can lead to system crashes or unauthorized access.
You can use tools like Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without any signup.
Exploitation of this vulnerability can lead to arbitrary code execution or denial of service, compromising system stability and security.
You can update your Linux kernel by running the command: sudo apt-get install linux=5.18.5-1 on Debian systems.
Currently, there are no specific workarounds available. The recommended action is to update to the patched version.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
