CVE-2022-48759

Vulnerability overview

In the Linux kernel, the following vulnerability has been resolved: rpmsg: char: Fix race between the release of rpmsg_ctrldev and cdev struct rpmsg_ctrldev contains a struct cdev. The current code frees the rpmsg_ctrldev struct in rpmsg_ctrldev_release_device(), but the cdev is a managed object, therefore its release is not predictable and the rpmsg_ctrldev could be freed before the cdev is entirely released, as in the backtrace below. [ 93.625603] ODEBUG: free active (active state 0) object type: timer_list hint: delayed_work_timer_fn+0x0/0x7c [ 93.636115] WARNING: CPU: 0 PID: 12 at lib/d...

Affected product and versions

Product

Linux Linux, linux kernel

Affected versions

>= c0cdc19f84a4712cf74888f83af286e3c2e14efd < 74d85e9fbc7022a4011102c7474a9c7aeb704a35, >= c0cdc19f84a4712cf74888f83af286e3c2e14efd < 70cb4295ec806b663665e1d2ed15caab6159880e, >= c0cdc19f84a4712cf74888f83af286e3c2e14efd < da27b834c1e0222e149e06caddf7718478086d1b, >= c0cdc19f84a4712cf74888f83af286e3c2e14efd < 1dbb206730f3e5ce90014ad569ddf8167ec4124a, >= c0cdc19f84a4712cf74888f83af286e3c2e14efd < 85aba11a8ea92a8eef2de95ebbe063086fd62d9c, >= c0cdc19f84a4712cf74888f83af286e3c2e14efd < d6cdc6ae542845d4d0ac8b6d99362bde7042a3c7, >= c0cdc19f84a4712cf74888f83af286e3c2e14efd < b7fb2dad571d1e21173c06cef0bced77b323990a, >= 4.11, >= 4.11 < 4.14.265, >= 4.15 < 4.19.228, >= 4.20 < 5.4.176, >= 5.5 < 5.10.96, >= 5.11 < 5.15.19, >= 5.16 < 5.16.5, 5.17

Fixed versions

4.14.265, 4.19.228, 5.4.176, 5.10.96, 5.15.19, 5.16.5

Technical data

CVSS vector

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-362, CWE-416