284 lines
14 KiB
JSON
284 lines
14 KiB
JSON
{
|
||
"dataType": "CVE_RECORD",
|
||
"dataVersion": "5.2",
|
||
"cveMetadata": {
|
||
"cveId": "CVE-2022-49385",
|
||
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
||
"state": "PUBLISHED",
|
||
"assignerShortName": "Linux",
|
||
"dateReserved": "2025-02-26T02:08:31.560Z",
|
||
"datePublished": "2025-02-26T02:11:20.725Z",
|
||
"dateUpdated": "2026-08-05T08:54:58.796Z"
|
||
},
|
||
"containers": {
|
||
"cna": {
|
||
"providerMetadata": {
|
||
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
||
"shortName": "Linux",
|
||
"dateUpdated": "2026-08-05T08:54:58.796Z"
|
||
},
|
||
"descriptions": [
|
||
{
|
||
"lang": "en",
|
||
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndriver: base: fix UAF when driver_attach failed\n\nWhen driver_attach(drv); failed, the driver_private will be freed.\nBut it has been added to the bus, which caused a UAF.\n\nTo fix it, we need to delete it from the bus when failed."
|
||
}
|
||
],
|
||
"metrics": [
|
||
{
|
||
"cvssV3_1": {
|
||
"version": "3.1",
|
||
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
|
||
"baseScore": 7.8,
|
||
"baseSeverity": "HIGH"
|
||
},
|
||
"scenarios": [
|
||
{
|
||
"lang": "en",
|
||
"value": "AV:L - The vulnerable path is bus_add_driver() in the local driver core, reached via driver_register() during module load/autoload or privileged driver bind—not via network packet processing or adjacent-link protocols.\nAC:L - Once driver_attach() returns an error, kobject_put frees driver_private while knode_bus remains linked on klist_drivers with no get/put callbacks, leaving a permanent dangling list node; subsequent bus_for_each_drv()/device_attach iteration hits the UAF deterministically with no race the attacker must win.\nPR:L - Although direct init_module requires CAP_SYS_MODULE, unprivileged local users can trigger module autoload (request_module via sockets, filesystems, etc.) so that modprobe runs driver_register() in kernel context, and after the dangling entry is planted any local user can exercise bus driver iteration; when uncertain, Low is required over High.\nUI:N - The attacker triggers driver registration and later bus_for_each_drv use themselves through local operations; no separate victim action such as mounting a filesystem or opening a crafted file is required.\nS:U - Impact is use-after-free of kernel driver_private within the host kernel’s driver-core lists, enabling standard local privilege escalation in the same security authority without VM escape or IOMMU/sandbox boundary crossing.\nC:H - Use-after-free of the kmalloc’d driver_private (containing kobject and driver pointer) allows heap reuse and arbitrary kernel memory disclosure when next_driver()/bus_for_each_drv walks the dangling knode, scored Confidentiality High per UAF guidance.\nI:H - The same UAF on a list-linked slab object enables heap spraying and corruption of adjacent kernel objects or control-flow hijack when driver matching/probe paths dereference the reclaimed driver_private, scored Integrity High.\nA:H - Walking a freed klist_node or dereferencing drv_priv->driver after free can oops/panic the kernel even without full exploitation, so Availability impact is High."
|
||
}
|
||
]
|
||
}
|
||
],
|
||
"affected": [
|
||
{
|
||
"product": "Linux",
|
||
"vendor": "Linux",
|
||
"defaultStatus": "unaffected",
|
||
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
|
||
"programFiles": [
|
||
"drivers/base/bus.c"
|
||
],
|
||
"versions": [
|
||
{
|
||
"version": "190888ac01d059e38ffe77a2291d44cafa9016fb",
|
||
"lessThan": "5d709f58c743166fe1c6914b9de0ae8868600d9b",
|
||
"status": "affected",
|
||
"versionType": "git"
|
||
},
|
||
{
|
||
"version": "190888ac01d059e38ffe77a2291d44cafa9016fb",
|
||
"lessThan": "823f24f2e329babd0330200d0b74882516fe57f4",
|
||
"status": "affected",
|
||
"versionType": "git"
|
||
},
|
||
{
|
||
"version": "190888ac01d059e38ffe77a2291d44cafa9016fb",
|
||
"lessThan": "cdf1a683a01583bca4b618dd16223cbd6e462e21",
|
||
"status": "affected",
|
||
"versionType": "git"
|
||
},
|
||
{
|
||
"version": "190888ac01d059e38ffe77a2291d44cafa9016fb",
|
||
"lessThan": "5389101257828d1913d713d9a40acbe14f5961df",
|
||
"status": "affected",
|
||
"versionType": "git"
|
||
},
|
||
{
|
||
"version": "190888ac01d059e38ffe77a2291d44cafa9016fb",
|
||
"lessThan": "c059665c84feab46b7173d3a1bf36c2fb7f9df86",
|
||
"status": "affected",
|
||
"versionType": "git"
|
||
},
|
||
{
|
||
"version": "190888ac01d059e38ffe77a2291d44cafa9016fb",
|
||
"lessThan": "310862e574001a97ad02272bac0fd13f75f42a27",
|
||
"status": "affected",
|
||
"versionType": "git"
|
||
}
|
||
]
|
||
},
|
||
{
|
||
"product": "Linux",
|
||
"vendor": "Linux",
|
||
"defaultStatus": "affected",
|
||
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
|
||
"programFiles": [
|
||
"drivers/base/bus.c"
|
||
],
|
||
"versions": [
|
||
{
|
||
"version": "3.9",
|
||
"status": "affected"
|
||
},
|
||
{
|
||
"version": "0",
|
||
"lessThan": "3.9",
|
||
"status": "unaffected",
|
||
"versionType": "semver"
|
||
},
|
||
{
|
||
"version": "5.4.198",
|
||
"lessThanOrEqual": "5.4.*",
|
||
"status": "unaffected",
|
||
"versionType": "semver"
|
||
},
|
||
{
|
||
"version": "5.10.122",
|
||
"lessThanOrEqual": "5.10.*",
|
||
"status": "unaffected",
|
||
"versionType": "semver"
|
||
},
|
||
{
|
||
"version": "5.15.47",
|
||
"lessThanOrEqual": "5.15.*",
|
||
"status": "unaffected",
|
||
"versionType": "semver"
|
||
},
|
||
{
|
||
"version": "5.17.15",
|
||
"lessThanOrEqual": "5.17.*",
|
||
"status": "unaffected",
|
||
"versionType": "semver"
|
||
},
|
||
{
|
||
"version": "5.18.4",
|
||
"lessThanOrEqual": "5.18.*",
|
||
"status": "unaffected",
|
||
"versionType": "semver"
|
||
},
|
||
{
|
||
"version": "5.19",
|
||
"lessThanOrEqual": "*",
|
||
"status": "unaffected",
|
||
"versionType": "original_commit_for_fix"
|
||
}
|
||
]
|
||
}
|
||
],
|
||
"cpeApplicability": [
|
||
{
|
||
"nodes": [
|
||
{
|
||
"operator": "OR",
|
||
"negate": false,
|
||
"cpeMatch": [
|
||
{
|
||
"vulnerable": true,
|
||
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
||
"versionStartIncluding": "3.9",
|
||
"versionEndExcluding": "5.4.198"
|
||
},
|
||
{
|
||
"vulnerable": true,
|
||
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
||
"versionStartIncluding": "3.9",
|
||
"versionEndExcluding": "5.10.122"
|
||
},
|
||
{
|
||
"vulnerable": true,
|
||
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
||
"versionStartIncluding": "3.9",
|
||
"versionEndExcluding": "5.15.47"
|
||
},
|
||
{
|
||
"vulnerable": true,
|
||
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
||
"versionStartIncluding": "3.9",
|
||
"versionEndExcluding": "5.17.15"
|
||
},
|
||
{
|
||
"vulnerable": true,
|
||
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
||
"versionStartIncluding": "3.9",
|
||
"versionEndExcluding": "5.18.4"
|
||
},
|
||
{
|
||
"vulnerable": true,
|
||
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
||
"versionStartIncluding": "3.9",
|
||
"versionEndExcluding": "5.19"
|
||
}
|
||
]
|
||
}
|
||
]
|
||
}
|
||
],
|
||
"references": [
|
||
{
|
||
"url": "https://git.kernel.org/stable/c/5d709f58c743166fe1c6914b9de0ae8868600d9b"
|
||
},
|
||
{
|
||
"url": "https://git.kernel.org/stable/c/823f24f2e329babd0330200d0b74882516fe57f4"
|
||
},
|
||
{
|
||
"url": "https://git.kernel.org/stable/c/cdf1a683a01583bca4b618dd16223cbd6e462e21"
|
||
},
|
||
{
|
||
"url": "https://git.kernel.org/stable/c/5389101257828d1913d713d9a40acbe14f5961df"
|
||
},
|
||
{
|
||
"url": "https://git.kernel.org/stable/c/c059665c84feab46b7173d3a1bf36c2fb7f9df86"
|
||
},
|
||
{
|
||
"url": "https://git.kernel.org/stable/c/310862e574001a97ad02272bac0fd13f75f42a27"
|
||
}
|
||
],
|
||
"title": "driver: base: fix UAF when driver_attach failed",
|
||
"x_generator": {
|
||
"engine": "bippy-1.2.0"
|
||
}
|
||
},
|
||
"adp": [
|
||
{
|
||
"metrics": [
|
||
{
|
||
"cvssV3_1": {
|
||
"scope": "UNCHANGED",
|
||
"version": "3.1",
|
||
"baseScore": 7.8,
|
||
"attackVector": "LOCAL",
|
||
"baseSeverity": "HIGH",
|
||
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
|
||
"integrityImpact": "HIGH",
|
||
"userInteraction": "NONE",
|
||
"attackComplexity": "LOW",
|
||
"availabilityImpact": "HIGH",
|
||
"privilegesRequired": "LOW",
|
||
"confidentialityImpact": "HIGH"
|
||
}
|
||
},
|
||
{
|
||
"other": {
|
||
"type": "ssvc",
|
||
"content": {
|
||
"id": "CVE-2022-49385",
|
||
"role": "CISA Coordinator",
|
||
"options": [
|
||
{
|
||
"Exploitation": "none"
|
||
},
|
||
{
|
||
"Automatable": "no"
|
||
},
|
||
{
|
||
"Technical Impact": "total"
|
||
}
|
||
],
|
||
"version": "2.0.3",
|
||
"timestamp": "2025-02-27T17:58:41.954887Z"
|
||
}
|
||
}
|
||
}
|
||
],
|
||
"problemTypes": [
|
||
{
|
||
"descriptions": [
|
||
{
|
||
"lang": "en",
|
||
"type": "CWE",
|
||
"cweId": "CWE-416",
|
||
"description": "CWE-416 Use After Free"
|
||
}
|
||
]
|
||
}
|
||
],
|
||
"title": "CISA ADP Vulnrichment",
|
||
"providerMetadata": {
|
||
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
||
"shortName": "CISA-ADP",
|
||
"dateUpdated": "2025-02-27T18:02:28.951Z"
|
||
}
|
||
}
|
||
]
|
||
}
|
||
} |