251 lines
12 KiB
JSON
251 lines
12 KiB
JSON
{
|
||
"dataType": "CVE_RECORD",
|
||
"dataVersion": "5.2",
|
||
"cveMetadata": {
|
||
"cveId": "CVE-2022-48873",
|
||
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
||
"state": "PUBLISHED",
|
||
"assignerShortName": "Linux",
|
||
"dateReserved": "2024-07-16T11:38:08.921Z",
|
||
"datePublished": "2024-08-21T06:10:04.024Z",
|
||
"dateUpdated": "2026-08-05T08:52:44.074Z"
|
||
},
|
||
"containers": {
|
||
"cna": {
|
||
"providerMetadata": {
|
||
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
||
"shortName": "Linux",
|
||
"dateUpdated": "2026-08-05T08:52:44.074Z"
|
||
},
|
||
"descriptions": [
|
||
{
|
||
"lang": "en",
|
||
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmisc: fastrpc: Don't remove map on creater_process and device_release\n\nDo not remove the map from the list on error path in\nfastrpc_init_create_process, instead call fastrpc_map_put, to avoid\nuse-after-free. Do not remove it on fastrpc_device_release either,\ncall fastrpc_map_put instead.\n\nThe fastrpc_free_map is the only proper place to remove the map.\nThis is called only after the reference count is 0."
|
||
}
|
||
],
|
||
"metrics": [
|
||
{
|
||
"cvssV3_1": {
|
||
"version": "3.1",
|
||
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
|
||
"baseScore": 7.8,
|
||
"baseSeverity": "HIGH"
|
||
},
|
||
"scenarios": [
|
||
{
|
||
"lang": "en",
|
||
"value": "AV:L - The bug is reached through local ioctl/close on the fastrpc misc device (/dev/fastrpc-*), not via network packet processing. Unprivileged apps on Qualcomm Android can obtain the device fd through the DSP HAL.\nAC:L - An attacker who can open the device fully controls map creation, INIT_CREATE error paths (allocation/invoke failure or timeout), and device_release, so the UAF is reliably triggerable without depending on conditions outside their influence.\nPR:L - The driver is designed for untrusted apps on non-secure fastrpc nodes, and Android apps can obtain the fd via IDspService/DSP HAL without being root. No real root/init-namespace capability is required.\nUI:N - Exploitation needs only the attacker’s own open/ioctl/close sequence; no victim action is required.\nS:U - Impact is kernel memory corruption and local privilege escalation within the same OS security authority, not a VM/IOMMU sandbox escape.\nC:H - Use-after-free of fastrpc_map objects enables heap reuse and arbitrary kernel read primitives per standard UAF exploitation.\nI:H - The same UAF enables heap spraying and arbitrary write/control-flow hijacking in the kernel.\nA:H - Use-after-free of list-linked map objects can cause kernel oops/panic even without full exploitation."
|
||
}
|
||
]
|
||
}
|
||
],
|
||
"affected": [
|
||
{
|
||
"product": "Linux",
|
||
"vendor": "Linux",
|
||
"defaultStatus": "unaffected",
|
||
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
|
||
"programFiles": [
|
||
"drivers/misc/fastrpc.c"
|
||
],
|
||
"versions": [
|
||
{
|
||
"version": "b49f6d83e290f17e20f4e5cf31288d3bb4955ea6",
|
||
"lessThan": "4b5c44e924a571d0ad07054de549624fbc04e4d7",
|
||
"status": "affected",
|
||
"versionType": "git"
|
||
},
|
||
{
|
||
"version": "b49f6d83e290f17e20f4e5cf31288d3bb4955ea6",
|
||
"lessThan": "193cd853145b63e670bd73740250983af1475330",
|
||
"status": "affected",
|
||
"versionType": "git"
|
||
},
|
||
{
|
||
"version": "b49f6d83e290f17e20f4e5cf31288d3bb4955ea6",
|
||
"lessThan": "1b7b7bb400dd13dcb03fc6e591bb7ca4664bbec8",
|
||
"status": "affected",
|
||
"versionType": "git"
|
||
},
|
||
{
|
||
"version": "b49f6d83e290f17e20f4e5cf31288d3bb4955ea6",
|
||
"lessThan": "35ddd482345c43d9eec1f3406c0f20a95ed4054b",
|
||
"status": "affected",
|
||
"versionType": "git"
|
||
},
|
||
{
|
||
"version": "b49f6d83e290f17e20f4e5cf31288d3bb4955ea6",
|
||
"lessThan": "5bb96c8f9268e2fdb0e5321cbc358ee5941efc15",
|
||
"status": "affected",
|
||
"versionType": "git"
|
||
},
|
||
{
|
||
"version": "aaf5aa44934ad069cac805923c49f6968b9a0d49",
|
||
"status": "affected",
|
||
"versionType": "git"
|
||
},
|
||
{
|
||
"version": "5.1.6",
|
||
"lessThan": "5.2",
|
||
"status": "affected",
|
||
"versionType": "semver"
|
||
}
|
||
]
|
||
},
|
||
{
|
||
"product": "Linux",
|
||
"vendor": "Linux",
|
||
"defaultStatus": "affected",
|
||
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
|
||
"programFiles": [
|
||
"drivers/misc/fastrpc.c"
|
||
],
|
||
"versions": [
|
||
{
|
||
"version": "5.2",
|
||
"status": "affected"
|
||
},
|
||
{
|
||
"version": "0",
|
||
"lessThan": "5.2",
|
||
"status": "unaffected",
|
||
"versionType": "semver"
|
||
},
|
||
{
|
||
"version": "5.4.230",
|
||
"lessThanOrEqual": "5.4.*",
|
||
"status": "unaffected",
|
||
"versionType": "semver"
|
||
},
|
||
{
|
||
"version": "5.10.165",
|
||
"lessThanOrEqual": "5.10.*",
|
||
"status": "unaffected",
|
||
"versionType": "semver"
|
||
},
|
||
{
|
||
"version": "5.15.90",
|
||
"lessThanOrEqual": "5.15.*",
|
||
"status": "unaffected",
|
||
"versionType": "semver"
|
||
},
|
||
{
|
||
"version": "6.1.8",
|
||
"lessThanOrEqual": "6.1.*",
|
||
"status": "unaffected",
|
||
"versionType": "semver"
|
||
},
|
||
{
|
||
"version": "6.2",
|
||
"lessThanOrEqual": "*",
|
||
"status": "unaffected",
|
||
"versionType": "original_commit_for_fix"
|
||
}
|
||
]
|
||
}
|
||
],
|
||
"cpeApplicability": [
|
||
{
|
||
"nodes": [
|
||
{
|
||
"operator": "OR",
|
||
"negate": false,
|
||
"cpeMatch": [
|
||
{
|
||
"vulnerable": true,
|
||
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
||
"versionStartIncluding": "5.2",
|
||
"versionEndExcluding": "5.4.230"
|
||
},
|
||
{
|
||
"vulnerable": true,
|
||
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
||
"versionStartIncluding": "5.2",
|
||
"versionEndExcluding": "5.10.165"
|
||
},
|
||
{
|
||
"vulnerable": true,
|
||
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
||
"versionStartIncluding": "5.2",
|
||
"versionEndExcluding": "5.15.90"
|
||
},
|
||
{
|
||
"vulnerable": true,
|
||
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
||
"versionStartIncluding": "5.2",
|
||
"versionEndExcluding": "6.1.8"
|
||
},
|
||
{
|
||
"vulnerable": true,
|
||
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
||
"versionStartIncluding": "5.2",
|
||
"versionEndExcluding": "6.2"
|
||
},
|
||
{
|
||
"vulnerable": true,
|
||
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
||
"versionStartIncluding": "5.1.6"
|
||
}
|
||
]
|
||
}
|
||
]
|
||
}
|
||
],
|
||
"references": [
|
||
{
|
||
"url": "https://git.kernel.org/stable/c/4b5c44e924a571d0ad07054de549624fbc04e4d7"
|
||
},
|
||
{
|
||
"url": "https://git.kernel.org/stable/c/193cd853145b63e670bd73740250983af1475330"
|
||
},
|
||
{
|
||
"url": "https://git.kernel.org/stable/c/1b7b7bb400dd13dcb03fc6e591bb7ca4664bbec8"
|
||
},
|
||
{
|
||
"url": "https://git.kernel.org/stable/c/35ddd482345c43d9eec1f3406c0f20a95ed4054b"
|
||
},
|
||
{
|
||
"url": "https://git.kernel.org/stable/c/5bb96c8f9268e2fdb0e5321cbc358ee5941efc15"
|
||
}
|
||
],
|
||
"title": "misc: fastrpc: Don't remove map on creater_process and device_release",
|
||
"x_generator": {
|
||
"engine": "bippy-1.2.0"
|
||
}
|
||
},
|
||
"adp": [
|
||
{
|
||
"metrics": [
|
||
{
|
||
"other": {
|
||
"type": "ssvc",
|
||
"content": {
|
||
"id": "CVE-2022-48873",
|
||
"role": "CISA Coordinator",
|
||
"options": [
|
||
{
|
||
"Exploitation": "none"
|
||
},
|
||
{
|
||
"Automatable": "no"
|
||
},
|
||
{
|
||
"Technical Impact": "partial"
|
||
}
|
||
],
|
||
"version": "2.0.3",
|
||
"timestamp": "2024-09-10T16:05:22.474051Z"
|
||
}
|
||
}
|
||
}
|
||
],
|
||
"title": "CISA ADP Vulnrichment",
|
||
"providerMetadata": {
|
||
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
||
"shortName": "CISA-ADP",
|
||
"dateUpdated": "2024-09-12T17:32:53.911Z"
|
||
}
|
||
}
|
||
]
|
||
}
|
||
} |