CVE-2022-49114

Summary

In the Linux kernel, the following vulnerability has been resolved:

scsi: libfc: Fix use after free in fc_exch_abts_resp()

fc_exch_release(ep) will decrease the ep's reference count. When the reference count reaches zero, it is freed. But ep is still used in the following code, which will lead to a use after free.

Return after the fc_exch_release() call to avoid use after free.

Affected Software

VendorProductVersion RangeStatus
LinuxLinux42e9a92fe6a9095bd68a379aaec7ad2be0337f7a < 4a131d4ea8b581ac9b01d3a72754db4848be3232affected
LinuxLinux42e9a92fe6a9095bd68a379aaec7ad2be0337f7a < 499d198494e77b6533251b9b909baf5c101129cbaffected
LinuxLinux42e9a92fe6a9095bd68a379aaec7ad2be0337f7a < 6044ad64f41c87382cfeeca281573d1886d80cbeaffected
LinuxLinux42e9a92fe6a9095bd68a379aaec7ad2be0337f7a < 5cf2ce8967b0d98c8cfa4dc42ef4fcf080f5c836affected
LinuxLinux42e9a92fe6a9095bd68a379aaec7ad2be0337f7a < 1d7effe5fff9d28e45e18ac3a564067c7ddfe898affected
LinuxLinux42e9a92fe6a9095bd68a379aaec7ad2be0337f7a < f581df412bc45c95176e3c808ee2839c05b2ab0caffected
LinuxLinux42e9a92fe6a9095bd68a379aaec7ad2be0337f7a < 87909291762d08fdb60d19069d7a89b5b308d0efaffected
LinuxLinux42e9a92fe6a9095bd68a379aaec7ad2be0337f7a < 412dd8299b02e4410fe77b8396953c1a8dde183aaffected
LinuxLinux42e9a92fe6a9095bd68a379aaec7ad2be0337f7a < 271add11994ba1a334859069367e04d2be2ebdd4affected
LinuxLinux2.6.29affected
LinuxLinux0 < 2.6.29unaffected
LinuxLinux4.9.311 <= 4.9.*unaffected
LinuxLinux4.14.276 <= 4.14.*unaffected
LinuxLinux4.19.238 <= 4.19.*unaffected
LinuxLinux5.4.189 <= 5.4.*unaffected
LinuxLinux5.10.111 <= 5.10.*unaffected
LinuxLinux5.15.34 <= 5.15.*unaffected
LinuxLinux5.16.20 <= 5.16.*unaffected
LinuxLinux5.17.3 <= 5.17.*unaffected
LinuxLinux5.18 <= *unaffected

Weaknesses

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: no
    • Technical Impact: total

References