Use-after-free in Linux kernel - CVE-2022-24122

Vulnerability identifier: #VU60167

CSH Severity: Low

CVSS v4 BT: 7.1 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/U:Clear]

CVE-ID: CVE-2022-24122

CWE-ID: CWE-416

Exploitation vector: Local access

Exploit availability: Public exploit is available

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error with in the kernel/ucount.c in Linux kernel, when unprivileged user namespaces are enabled. A local user can trigger a use-after-free error, because a ucounts object can outlive its namespace, and execute arbitrary ode with elevated privileges.

Linux kernel
Ubuntu
Fedora
linux-image-oem-20.04d (Ubuntu package)
linux-image-5.14.0-1022-oem (Ubuntu package)
kernel
kernel-headers
kernel-tools

Install updates from vendor's website.

linux-image-oem-20.04d (Ubuntu package) - update to 5.14.0.1022.19
linux-image-5.14.0-1022-oem (Ubuntu package) - update to 5.14.0-1022.24
kernel - addressed in versions 5.16.5-100.fc34, 5.16.5-200.fc35
kernel-headers - addressed in versions 5.16.5-100.fc34, 5.16.5-200.fc35
kernel-tools - addressed in versions 5.16.5-100.fc34, 5.16.5-200.fc35

• https://www.openwall.com/lists/oss-security/2022/01/29/1
• https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=f9d87929d451d3e649699d0f1d74f71f77ad38f5
• https://github.com/torvalds/linux/commit/f9d87929d451d3e649699d0f1d74f71f77ad38f5

• Privilege escalation in Linux kernel
• Ubuntu update for linux-oem-5.14
• Fedora 35 update for kernel, kernel-headers, kernel-tools
• Fedora 34 update for kernel, kernel-headers, kernel-tools