CVE-2022-49385

Summary

In the Linux kernel, the following vulnerability has been resolved:

driver: base: fix UAF when driver_attach failed

When driver_attach(drv); failed, the driver_private will be freed. But it has been added to the bus, which caused a UAF.

To fix it, we need to delete it from the bus when failed.

Affected Software

VendorProductVersion RangeStatus
LinuxLinux190888ac01d059e38ffe77a2291d44cafa9016fb < 5d709f58c743166fe1c6914b9de0ae8868600d9baffected
LinuxLinux190888ac01d059e38ffe77a2291d44cafa9016fb < 823f24f2e329babd0330200d0b74882516fe57f4affected
LinuxLinux190888ac01d059e38ffe77a2291d44cafa9016fb < cdf1a683a01583bca4b618dd16223cbd6e462e21affected
LinuxLinux190888ac01d059e38ffe77a2291d44cafa9016fb < 5389101257828d1913d713d9a40acbe14f5961dfaffected
LinuxLinux190888ac01d059e38ffe77a2291d44cafa9016fb < c059665c84feab46b7173d3a1bf36c2fb7f9df86affected
LinuxLinux190888ac01d059e38ffe77a2291d44cafa9016fb < 310862e574001a97ad02272bac0fd13f75f42a27affected
LinuxLinux3.9affected
LinuxLinux0 < 3.9unaffected
LinuxLinux5.4.198 <= 5.4.*unaffected
LinuxLinux5.10.122 <= 5.10.*unaffected
LinuxLinux5.15.47 <= 5.15.*unaffected
LinuxLinux5.17.15 <= 5.17.*unaffected
LinuxLinux5.18.4 <= 5.18.*unaffected
LinuxLinux5.19 <= *unaffected

Weaknesses

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: no
    • Technical Impact: total

References