Critical Use-After-Free Vulnerability in Linux Kernel (CVE-2022-49412)
Summary
CVE-2022-49412: In the Linux kernel, the following vulnerability has been resolved: bfq: Avoid merging queues with different parents It can happen that the parent of a bfqq changes between the moment we decide two queues are worth to me... Affects linux versions < 5.18.5-1. Fixed in 5.18.5-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of many operating systems, managing hardware resources and providing essential services for software applications. It is known for its stability, performance, and security features. However, like any complex software, it is susceptible to vulnerabilities that can impact system integrity and security. CVE-2022-49412 is a significant vulnerability that affects the bfq (Budget Fair Queueing) I/O scheduler, which is responsible for managing input/output operations in a fair and efficient manner.
Vulnerability Detail
CVE-2022-49412 is a use-after-free vulnerability that occurs in the bfq I/O scheduler of the Linux kernel. The issue arises when the parent of a bfqq (bfq queue) changes between the decision to merge two queues and the execution of the merge. This can happen if a process submits I/O for a different cgroup, causing the bfqq to be reparented. If the bfqq being merged has a parent cgroup that is offline and about to be destroyed, it can lead to use-after-free conditions, potentially resulting in system crashes or arbitrary code execution. The vulnerability was identified in the function __bfq_deactivate_entity, leading to a KASAN (Kernel Address Sanitizer) report of a use-after-free error.
How To Fix
Minimum fixed version
5.18.5-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. The best course of action is to apply the patch by updating the kernel to the fixed version.
Conclusion
CVE-2022-49412 is a critical vulnerability in the Linux kernel that can lead to severe consequences if left unaddressed. Users are strongly advised to update their systems to the latest patched version to ensure security and stability. Utilizing tools like Vulert can further enhance vulnerability management and awareness.
See every vulnerability recorded for linux →
FAQ
CVE-2022-49412 is a use-after-free vulnerability in the Linux kernel's bfq I/O scheduler that can lead to system crashes or arbitrary code execution.
You can use tools like Vulert to monitor and alert for open-source vulnerabilities in your software. Check your application against CVE-2022-49412 using the Vulert playground.
If your system is vulnerable, you should update the Linux kernel to version 5.18.5-1 or later to mitigate the risk.
While specific exploits for CVE-2022-49412 have not been publicly disclosed, the nature of the vulnerability poses significant risks, including potential system crashes.
Vulert uses a manifest file like package-lock.json to monitor and alert in real-time for open-source vulnerabilities in your software, providing an easy way to stay informed.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
