Critical Double Free Vulnerability in Linux Kernel - CVE-2022-49391
Summary
CVE-2022-49391: In the Linux kernel, the following vulnerability has been resolved: remoteproc: mtk_scp: Fix a potential double free 'scp->rproc' is allocated using devm_rproc_alloc(), so there is no need to free it explicitly in the re... Affects linux versions < 5.18.5-1. Fixed in 5.18.5-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of many operating systems, including Debian. It manages hardware resources and provides essential services for software applications. The kernel is known for its stability and performance, but like any software, it can have vulnerabilities. CVE-2022-49391 specifically affects the remoteproc subsystem, which is responsible for managing remote processors in embedded systems. This vulnerability can lead to potential security risks if not addressed promptly.
Vulnerability Detail
CVE-2022-49391 is a critical vulnerability in the Linux kernel's remoteproc subsystem, specifically in the mtk_scp component. The issue arises from a potential double free of the 'scp->rproc' object, which is allocated using the devm_rproc_alloc() function. This means that the memory allocated for this object could be freed more than once, leading to undefined behavior, crashes, or even exploitation by an attacker. The vulnerability was resolved in version 5.18.5-1, ensuring that the memory management is handled correctly and preventing the double free scenario.
How To Fix
Minimum fixed version
5.18.5-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There are no specific workarounds mentioned for this vulnerability. The best course of action is to apply the patch by updating to the fixed version of the Linux package.
Conclusion
CVE-2022-49391 is a significant vulnerability in the Linux kernel that requires immediate attention. By updating to the patched version 5.18.5-1, users can protect their systems from potential exploitation. Regular monitoring and timely updates are essential for maintaining system security.
See every vulnerability recorded for linux →
FAQ
CVE-2022-49391 is a vulnerability in the Linux kernel's remoteproc subsystem that can lead to a double free condition, potentially causing crashes or security issues.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without any signup.
If exploited, this vulnerability could lead to system instability, crashes, or unauthorized access to system resources.
Yes, the vulnerability has been patched in version 5.18.5-1 of the Linux package.
While there are no specific workarounds, it is crucial to plan for an update as soon as possible to mitigate the risks associated with this vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
