Linux Kernel up to 5.4.179/5.10.100/5.15.23/5.16.9 fastrpc fput file descriptor consumption

Summaryinfo

A vulnerability was found in Linux Kernel up to 5.4.179/5.10.100/5.15.23/5.16.9. It has been rated as critical. This impacts the function fput of the component fastrpc. This manipulation causes file descriptor consumption. This vulnerability is handled as CVE-2022-48821. There is not any exploit available. Upgrading the affected component is advised.

Detailsinfo

A vulnerability classified as critical was found in Linux Kernel up to 5.4.179/5.10.100/5.15.23/5.16.9. Affected by this vulnerability is the function fput of the component fastrpc. The manipulation with an unknown input leads to a file descriptor consumption vulnerability. The CWE definition for the vulnerability is CWE-769. This entry has been deprecated because it was a duplicate of CWE-774. All content has been transferred to CWE-774. As an impact it is known to affect availability. The summary by CVE is:

In the Linux kernel, the following vulnerability has been resolved: misc: fastrpc: avoid double fput() on failed usercopy If the copy back to userland fails for the FASTRPC_IOCTL_ALLOC_DMA_BUFF ioctl(), we shouldn't assume that 'buf->dmabuf' is still valid. In fact, dma_buf_fd() called fd_install() before, i.e. "consumed" one reference, leaving us with none. Calling dma_buf_put() will therefore put a reference we no longer own, leading to a valid file descritor table entry for an already released 'file' object which is a straight use-after-free. Simply avoid calling dma_buf_put() and rely on the process exit code to do the necessary cleanup, if needed, i.e. if the file descriptor is still valid.

The advisory is shared at git.kernel.org. This vulnerability is known as CVE-2022-48821 since 07/16/2024. Technical details are known, but no exploit is available.

Upgrading to version 5.4.180, 5.10.101, 5.15.24 or 5.16.10 eliminates this vulnerability. Applying the patch 4e6fd2b5fcf8/a5ce7ee5fcc0/e4382d0a39f9/76f85c307ef9/46963e2e0629 is able to eliminate this problem. The bugfix is ready for download at git.kernel.org. The best possible mitigation is suggested to be upgrading to the latest version.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Type

• Operating System

Vendor

• Linux

Name

• Kernel

Version

• 5.0
• 5.1
• 5.2
• 5.3
• 5.4
• 5.4.179
• 5.5
• 5.6
• 5.7
• 5.8
• 5.9
• 5.10.100
• 5.15.0
• 5.15.1
• 5.15.2
• 5.15.3
• 5.15.4
• 5.15.5
• 5.15.6
• 5.15.7
• 5.15.8
• 5.15.9
• 5.15.10
• 5.15.11
• 5.15.12
• 5.15.13
• 5.15.14
• 5.15.15
• 5.15.16
• 5.15.17
• 5.15.18
• 5.15.19
• 5.15.20
• 5.15.21
• 5.15.22
• 5.15.23
• 5.16.0
• 5.16.1
• 5.16.2
• 5.16.3
• 5.16.4
• 5.16.5
• 5.16.6
• 5.16.7
• 5.16.8
• 5.16.9

License

• open-source

Website

• Vendor: https://www.kernel.org/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion