Linux Kernel SGI GRU Driver use after free

Summaryinfo

A vulnerability was found in Linux Kernel. It has been classified as critical. Affected is the function gru_set_context_option/gru_fault/gru_handle_user_call_os of the component SGI GRU Driver. Performing a manipulation results in use after free. This vulnerability is known as CVE-2022-3424. Remote exploitation of the attack is possible. No exploit is available. It is suggested to install a patch to address this issue.

Detailsinfo

A vulnerability, which was classified as critical, was found in Linux Kernel (Operating System) (unknown version). This affects the function gru_set_context_option/gru_fault/gru_handle_user_call_os of the component SGI GRU Driver. The manipulation with an unknown input leads to a use after free vulnerability. CWE is classifying the issue as CWE-416. Referencing memory after it has been freed can cause a program to crash, use unexpected values, or execute code. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

A use-after-free flaw was found in the Linux kernel’s SGI GRU driver in the way the first gru_file_unlocked_ioctl function is called by the user, where a fail pass occurs in the gru_check_chiplet_assignment function. This flaw allows a local user to crash or potentially escalate their privileges on the system.

The weakness was published 01/04/2023. The advisory is shared at bugzilla.redhat.com. This vulnerability is uniquely identified as CVE-2022-3424 since 10/07/2022. Technical details are known, but no exploit is available.

The vulnerability scanner Nessus provides a plugin with the ID 237260 (CentOS 9 : kernel-5.14.0-587.el9), which helps to determine the existence of the flaw in a target environment.

Applying the patch cf55d0464259dcffc302e31fc52a73249dc4b9fb is able to eliminate this problem. The bugfix is ready for download at github.com. The advisory contains the following remark:

misc: sgi-gru: fix use-after-free error in gru_set_context_option, gru_fault and gru_handle_user_call_os (CVE-2022-3424 bsc#1204166).

The vulnerability is also documented in the databases at Tenable (237260) and EUVD (EUVD-2022-42800). Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Type

• Operating System

Vendor

• Linux

Name

• Kernel

License

• open-source

Website

• Vendor: https://www.kernel.org/

CPE 2.3info

• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion