Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2022-48861— vdpa: fix use-after-free on vp_vdpa_remove

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel 存在安全漏洞，该漏洞源于vdpa模块中发现使用后释放问题。在vp_vdpa_remove期间，vp_vdpa被释放，然后在vp_modern_remove中被解引用，触发使用后释放。

AI Predicted 5.5 Difficulty: Moderate EPSS 0.20% · P10

Possible ATT&CK Techniques 1 AI

T1211 · Exploitation for Stealth

Affected Version Matrix 8

VendorProduct Version RangeStatus
Linux Linux 64b9f64f80a6f4b7ea51bf0510119cb15e801dc6< 4b1743bc715a3691a63ac21b349079b07bf1b19e affected
64b9f64f80a6f4b7ea51bf0510119cb15e801dc6< dc54ba9932aeaaa1a21fe214af1f446593a78274 affected
64b9f64f80a6f4b7ea51bf0510119cb15e801dc6< eb057b44dbe35ae14527830236a92f51de8f9184 affected
5.13 affected
< 5.13 unaffected
5.15.29≤ 5.15.* unaffected
5.16.15≤ 5.16.* unaffected
5.17≤ * unaffected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2022-48861

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
vdpa: fix use-after-free on vp_vdpa_remove
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: vdpa: fix use-after-free on vp_vdpa_remove When vp_vdpa driver is unbind, vp_vdpa is freed in vdpa_unregister_device and then vp_vdpa->mdev.pci_dev is dereferenced in vp_modern_remove, triggering use-after-free. Call Trace of unbinding driver free vp_vdpa : do_syscall_64 vfs_write kernfs_fop_write_iter device_release_driver_internal pci_device_remove vp_vdpa_remove vdpa_unregister_device kobject_release device_release kfree Call Trace of dereference vp_vdpa->mdev.pci_dev: vp_modern_remove pci_release_selected_regions pci_release_region pci_resource_len pci_resource_end (dev)->resource[(bar)].end
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel 存在安全漏洞，该漏洞源于vdpa模块中发现使用后释放问题。在vp_vdpa_remove期间，vp_vdpa被释放，然后在vp_modern_remove中被解引用，触发使用后释放。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux 64b9f64f80a6f4b7ea51bf0510119cb15e801dc6 ~ 4b1743bc715a3691a63ac21b349079b07bf1b19e -
Linux Linux 5.13 -

II. Public POCs for CVE-2022-48861

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2022-48861

请登录查看更多情报信息。

Other References for CVE-2022-48861 (3)

Same Patch Batch · Linux · 2024-07-16 · 98 CVEs total

CVE-2022-48788 9.8 CRITICAL nvme-rdma: fix possible use-after-free in transport error_recovery work
CVE-2022-48789 9.8 CRITICAL nvme-tcp: fix possible use-after-free in transport error_recovery work
CVE-2022-48851 9.8 CRITICAL staging: gdm724x: fix use after free in gdm_lte_rx()
CVE-2022-48790 9.8 CRITICAL nvme: fix a possible use-after-free in controller reset during load
CVE-2022-48829 9.1 CRITICAL NFSD: Fix NFSv3 SETATTR/CREATE's handling of large file sizes
CVE-2022-48828 9.1 CRITICAL NFSD: Fix ia_size underflow
CVE-2022-48785 8.8 HIGH ipv6: mcast: use rcu-safe version of ipv6_get_lladdr()
CVE-2022-48782 8.8 HIGH mctp: fix use after free
CVE-2022-48830 8.8 HIGH can: isotp: fix potential CAN frame reception race in isotp_rcv()
CVE-2022-48864 8.8 HIGH vdpa/mlx5: add validation for VIRTIO_NET_CTRL_MQ_VQ_PAIRS_SET command
CVE-2022-48791 7.8 HIGH scsi: pm8001: Fix use-after-free for aborted TMF sas_task
CVE-2022-48792 7.8 HIGH scsi: pm8001: Fix use-after-free for aborted SSP/STP sas_task
CVE-2022-48847 7.8 HIGH watch_queue: Fix filter limit check
CVE-2022-48839 7.8 HIGH net/packet: fix slab-out-of-bounds access in packet_recvmsg()
CVE-2022-48822 7.8 HIGH usb: f_fs: Fix use-after-free for epfile
CVE-2022-48821 7.8 HIGH misc: fastrpc: avoid double fput() on failed usercopy
CVE-2022-48816 7.8 HIGH SUNRPC: lock against ->sock changing during sysfs read
CVE-2022-48796 7.8 HIGH iommu: Fix potential use-after-free during probe
CVE-2022-48801 7.8 HIGH iio: buffer: Fix file related error handling in IIO_BUFFER_GET_FD_IOCTL
CVE-2024-41008 7.8 HIGH drm/amdgpu: change vm->task_info handling

Showing top 20 of 98 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2022-48861

No comments yet

Leave a comment