347 lines
17 KiB
JSON
347 lines
17 KiB
JSON
{
|
|
"dataType": "CVE_RECORD",
|
|
"dataVersion": "5.2",
|
|
"cveMetadata": {
|
|
"cveId": "CVE-2022-49114",
|
|
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
|
"state": "PUBLISHED",
|
|
"assignerShortName": "Linux",
|
|
"dateReserved": "2025-02-26T01:49:39.262Z",
|
|
"datePublished": "2025-02-26T01:54:58.172Z",
|
|
"dateUpdated": "2026-08-05T08:53:58.360Z"
|
|
},
|
|
"containers": {
|
|
"cna": {
|
|
"providerMetadata": {
|
|
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
|
"shortName": "Linux",
|
|
"dateUpdated": "2026-08-05T08:53:58.360Z"
|
|
},
|
|
"descriptions": [
|
|
{
|
|
"lang": "en",
|
|
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: libfc: Fix use after free in fc_exch_abts_resp()\n\nfc_exch_release(ep) will decrease the ep's reference count. When the\nreference count reaches zero, it is freed. But ep is still used in the\nfollowing code, which will lead to a use after free.\n\nReturn after the fc_exch_release() call to avoid use after free."
|
|
}
|
|
],
|
|
"metrics": [
|
|
{
|
|
"cvssV3_1": {
|
|
"version": "3.1",
|
|
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"baseScore": 8.8,
|
|
"baseSeverity": "HIGH"
|
|
},
|
|
"scenarios": [
|
|
{
|
|
"lang": "en",
|
|
"value": "AV:A - The vulnerable path processes Fibre Channel BLS frames (BA_ACC/BA_RJT) received over an FC SAN fabric or FCoE (ETH_P_FCOE) L2 segment from a peer on the same fabric/VLAN, which is adjacent-network topology, not Internet-routable IP.\nAC:L - An adjacent peer can induce exchange timeouts (delaying responses) so the host sends ABTS with a pending timer, then deliver a crafted BA_ACC/BA_RJT while that timer is still queued, reliably hitting the cancel-and-release path.\nPR:N - fc_exch_recv and the FCoE/HBA receive path accept frames from fabric peers with no OS credential or capability check; fabric zoning only constrains topology, not authenticated privileges on this code path.\nUI:N - Exploitation is fully driven by attacker-sent FC/FCoE frames against an already-configured initiator; no separate victim action such as mounting a volume or confirming a prompt is required.\nS:U - The use-after-free corrupts host kernel exchange/slab state within the same OS security authority and does not cross a VM, IOMMU, or sandbox boundary.\nC:H - Use-after-free of heap-allocated struct fc_exch lets an attacker reclaim the object and obtain arbitrary kernel-memory read primitives, which per guidance is High confidentiality impact.\nI:H - struct fc_exch embeds callable resp and destructor function pointers invoked from this path, so UAF plus heap spray enables arbitrary write and control-flow hijacking.\nA:H - Use-after-free of the exchange object causes kernel oops/panic even when not fully exploited, which is High availability impact and can be retried by sending further ABTS responses."
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"affected": [
|
|
{
|
|
"product": "Linux",
|
|
"vendor": "Linux",
|
|
"defaultStatus": "unaffected",
|
|
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
|
|
"programFiles": [
|
|
"drivers/scsi/libfc/fc_exch.c"
|
|
],
|
|
"versions": [
|
|
{
|
|
"version": "42e9a92fe6a9095bd68a379aaec7ad2be0337f7a",
|
|
"lessThan": "4a131d4ea8b581ac9b01d3a72754db4848be3232",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "42e9a92fe6a9095bd68a379aaec7ad2be0337f7a",
|
|
"lessThan": "499d198494e77b6533251b9b909baf5c101129cb",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "42e9a92fe6a9095bd68a379aaec7ad2be0337f7a",
|
|
"lessThan": "6044ad64f41c87382cfeeca281573d1886d80cbe",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "42e9a92fe6a9095bd68a379aaec7ad2be0337f7a",
|
|
"lessThan": "5cf2ce8967b0d98c8cfa4dc42ef4fcf080f5c836",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "42e9a92fe6a9095bd68a379aaec7ad2be0337f7a",
|
|
"lessThan": "1d7effe5fff9d28e45e18ac3a564067c7ddfe898",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "42e9a92fe6a9095bd68a379aaec7ad2be0337f7a",
|
|
"lessThan": "f581df412bc45c95176e3c808ee2839c05b2ab0c",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "42e9a92fe6a9095bd68a379aaec7ad2be0337f7a",
|
|
"lessThan": "87909291762d08fdb60d19069d7a89b5b308d0ef",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "42e9a92fe6a9095bd68a379aaec7ad2be0337f7a",
|
|
"lessThan": "412dd8299b02e4410fe77b8396953c1a8dde183a",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "42e9a92fe6a9095bd68a379aaec7ad2be0337f7a",
|
|
"lessThan": "271add11994ba1a334859069367e04d2be2ebdd4",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"product": "Linux",
|
|
"vendor": "Linux",
|
|
"defaultStatus": "affected",
|
|
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
|
|
"programFiles": [
|
|
"drivers/scsi/libfc/fc_exch.c"
|
|
],
|
|
"versions": [
|
|
{
|
|
"version": "2.6.29",
|
|
"status": "affected"
|
|
},
|
|
{
|
|
"version": "0",
|
|
"lessThan": "2.6.29",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "4.9.311",
|
|
"lessThanOrEqual": "4.9.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "4.14.276",
|
|
"lessThanOrEqual": "4.14.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "4.19.238",
|
|
"lessThanOrEqual": "4.19.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "5.4.189",
|
|
"lessThanOrEqual": "5.4.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "5.10.111",
|
|
"lessThanOrEqual": "5.10.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "5.15.34",
|
|
"lessThanOrEqual": "5.15.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "5.16.20",
|
|
"lessThanOrEqual": "5.16.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "5.17.3",
|
|
"lessThanOrEqual": "5.17.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "5.18",
|
|
"lessThanOrEqual": "*",
|
|
"status": "unaffected",
|
|
"versionType": "original_commit_for_fix"
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"cpeApplicability": [
|
|
{
|
|
"nodes": [
|
|
{
|
|
"operator": "OR",
|
|
"negate": false,
|
|
"cpeMatch": [
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "2.6.29",
|
|
"versionEndExcluding": "4.9.311"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "2.6.29",
|
|
"versionEndExcluding": "4.14.276"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "2.6.29",
|
|
"versionEndExcluding": "4.19.238"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "2.6.29",
|
|
"versionEndExcluding": "5.4.189"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "2.6.29",
|
|
"versionEndExcluding": "5.10.111"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "2.6.29",
|
|
"versionEndExcluding": "5.15.34"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "2.6.29",
|
|
"versionEndExcluding": "5.16.20"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "2.6.29",
|
|
"versionEndExcluding": "5.17.3"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "2.6.29",
|
|
"versionEndExcluding": "5.18"
|
|
}
|
|
]
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"references": [
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/4a131d4ea8b581ac9b01d3a72754db4848be3232"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/499d198494e77b6533251b9b909baf5c101129cb"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/6044ad64f41c87382cfeeca281573d1886d80cbe"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/5cf2ce8967b0d98c8cfa4dc42ef4fcf080f5c836"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/1d7effe5fff9d28e45e18ac3a564067c7ddfe898"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/f581df412bc45c95176e3c808ee2839c05b2ab0c"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/87909291762d08fdb60d19069d7a89b5b308d0ef"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/412dd8299b02e4410fe77b8396953c1a8dde183a"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/271add11994ba1a334859069367e04d2be2ebdd4"
|
|
}
|
|
],
|
|
"title": "scsi: libfc: Fix use after free in fc_exch_abts_resp()",
|
|
"x_generator": {
|
|
"engine": "bippy-1.2.0"
|
|
}
|
|
},
|
|
"adp": [
|
|
{
|
|
"metrics": [
|
|
{
|
|
"cvssV3_1": {
|
|
"scope": "UNCHANGED",
|
|
"version": "3.1",
|
|
"baseScore": 7.8,
|
|
"attackVector": "LOCAL",
|
|
"baseSeverity": "HIGH",
|
|
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
|
|
"integrityImpact": "HIGH",
|
|
"userInteraction": "NONE",
|
|
"attackComplexity": "LOW",
|
|
"availabilityImpact": "HIGH",
|
|
"privilegesRequired": "LOW",
|
|
"confidentialityImpact": "HIGH"
|
|
}
|
|
},
|
|
{
|
|
"other": {
|
|
"type": "ssvc",
|
|
"content": {
|
|
"id": "CVE-2022-49114",
|
|
"role": "CISA Coordinator",
|
|
"options": [
|
|
{
|
|
"Exploitation": "none"
|
|
},
|
|
{
|
|
"Automatable": "no"
|
|
},
|
|
{
|
|
"Technical Impact": "total"
|
|
}
|
|
],
|
|
"version": "2.0.3",
|
|
"timestamp": "2025-03-04T18:03:27.178498Z"
|
|
}
|
|
}
|
|
}
|
|
],
|
|
"problemTypes": [
|
|
{
|
|
"descriptions": [
|
|
{
|
|
"lang": "en",
|
|
"type": "CWE",
|
|
"cweId": "CWE-416",
|
|
"description": "CWE-416 Use After Free"
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"title": "CISA ADP Vulnrichment",
|
|
"providerMetadata": {
|
|
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
|
"shortName": "CISA-ADP",
|
|
"dateUpdated": "2025-03-04T18:07:17.816Z"
|
|
}
|
|
}
|
|
]
|
|
}
|
|
} |