SECUFOCUSNOW
Home›CVE index›CVE-2022-48695
Review reviewHigh

CVE-2022-48695

Linux Linux, linux kernel

In the Linux kernel, the following vulnerability has been resolved: scsi: mpt3sas: Fix use-after-free warning Fix the following use-after-free warning which is observed during controller reset: refcount_t: underflow; use-after-free. WARNING: CPU: 23 PID: 5399 at lib/refcount.c:28 refcount_warn_saturate+0xa6/0xf0

CVSS
7.8
EPSS
0.24%
15.2% percentile
CISA KEV
Not listed
Published
2024.05.04
PRIORITY ASSESSMENT

Review review

The CVSS severity warrants an early asset and exposure review.

Known exploitationNot established by KEV
Exploit probability0.24%
Technical severityCVSS 7.8

Vulnerability overview

In the Linux kernel, the following vulnerability has been resolved: scsi: mpt3sas: Fix use-after-free warning Fix the following use-after-free warning which is observed during controller reset: refcount_t: underflow; use-after-free. WARNING: CPU: 23 PID: 5399 at lib/refcount.c:28 refcount_warn_saturate+0xa6/0xf0

Affected product and versions

Product
Linux Linux, linux kernel
Affected versions
>= 146b16c8071f5f6c67895d15beeee1163f5107c4 < b8fc9e91b931215110ba824d1a2983c5f60b6f82, >= 146b16c8071f5f6c67895d15beeee1163f5107c4 < d4959d09b76eb7a4146f5133962b88d3bddb63d6, >= 146b16c8071f5f6c67895d15beeee1163f5107c4 < 82efb917eeb27454dc4c6fe26432fc8f6c75bc16, >= 146b16c8071f5f6c67895d15beeee1163f5107c4 < 5682c94644fde72f72bded6580c38189ffc856b5, >= 146b16c8071f5f6c67895d15beeee1163f5107c4 < ea10a652ad2ae2cf3eced6f632a5c98f26727057, >= 146b16c8071f5f6c67895d15beeee1163f5107c4 < 6229fa494a5949be209bc73afbc5d0a749c2e3c7, >= 146b16c8071f5f6c67895d15beeee1163f5107c4 < 41acb064c4e013808bc7d5fc1b506fa449425b0b, >= 146b16c8071f5f6c67895d15beeee1163f5107c4 < 991df3dd5144f2e6b1c38b8d20ed3d4d21e20b34, >= 4.4, < 4.9.328, >= 4.10 < 4.14.293, >= 4.15 < 4.19.258, >= 4.20 < 5.4.213, >= 5.5 < 5.10.143, >= 5.11 < 5.15.168, >= 5.16 < 5.19.9, 6.0
Fixed versions
4.9.328, 4.14.293, 4.19.258, 5.4.213, 5.10.143, 5.15.168, 5.19.9

Recommended response sequence

Confirm exposure before applying a vendor-supported change.

Full remediation guide
  1. 1
    Identify

    Confirm that Linux Linux, linux kernel and an affected version are present.

  2. 2
    Prioritize

    Combine exploitation signals with asset exposure and business criticality.

  3. 3
    Remediate

    Follow the vendor advisory or supported update path and preserve rollback options.

  4. 4
    Verify

    Recheck the version, service health, access paths, and relevant logs.

Technical data

CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE
CWE-416