Use-after-free in Linux kernel - CVE-2022-1786

Vulnerability identifier: #VU64260

CSH Severity: Low

CVSS v4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2022-1786

CWE-ID: CWE-416

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error in the Linux kernel’s io_uring subsystem in the way a user sets up a ring with IORING_SETUP_IOPOLL with more than one task completing submissions on this ring. A local user can trigger use-after-free to crash the system or escalate their privileges.

Linux kernel
Anolis OS
Google Android
openEuler
kernel-devel
kernel-tools
perf-debuginfo
perf
python3-perf-debuginfo
kernel-source
kernel-tools-devel
bpftool
kernel-debuginfo
python2-perf-debuginfo
python2-perf
kernel
bpftool-debuginfo
python3-perf
kernel-tools-debuginfo
kernel-debugsource
linux (Debian package)
kernel-tools-libs
kernel-tools-libs-devel
kernel-modules-internal
kernel-modules-extra
kernel-modules
kernel-headers
kernel-debug-modules-extra
kernel-debug-modules
kernel-debug-devel
kernel-debug-core
kernel-debug
kernel-core

Install updates from vendor's website.

Google Android - addressed in versions 10 2022-08-05, 11 2022-08-05, 12L 2022-08-05, 12 2022-08-05
kernel-devel - update to 4.19.90-2206.2.0.0154
kernel-tools - update to 4.19.90-2206.2.0.0154
perf-debuginfo - update to 4.19.90-2206.2.0.0154
perf - update to 4.19.90-2206.2.0.0154
python3-perf-debuginfo - update to 4.19.90-2206.2.0.0154
kernel-source - update to 4.19.90-2206.2.0.0154
kernel-tools-devel - update to 4.19.90-2206.2.0.0154
bpftool - update to 4.19.90-2206.2.0.0154
kernel-debuginfo - update to 4.19.90-2206.2.0.0154
python2-perf-debuginfo - update to 4.19.90-2206.2.0.0154
python2-perf - update to 4.19.90-2206.2.0.0154
kernel - update to 4.19.90-2206.2.0.0154
bpftool-debuginfo - update to 4.19.90-2206.2.0.0154
python3-perf - update to 4.19.90-2206.2.0.0154
kernel-tools-debuginfo - update to 4.19.90-2206.2.0.0154
kernel-debugsource - update to 4.19.90-2206.2.0.0154
linux (Debian package) - update to 5.10.120-1
kernel-tools-libs - update to 5.10.134-12
kernel-tools-libs-devel - update to 5.10.134-12
perf - update to 5.10.134-12
python3-perf - update to 5.10.134-12
kernel-tools - update to 5.10.134-12
kernel-modules-internal - update to 5.10.134-12
kernel-modules-extra - update to 5.10.134-12
kernel-modules - update to 5.10.134-12
kernel-headers - update to 5.10.134-12
kernel-devel - update to 5.10.134-12
kernel-debug-modules-extra - update to 5.10.134-12
kernel-debug-modules - update to 5.10.134-12
kernel-debug-devel - update to 5.10.134-12
kernel-debug-core - update to 5.10.134-12
kernel-debug - update to 5.10.134-12
kernel-core - update to 5.10.134-12
kernel - update to 5.10.134-12
bpftool - update to 5.10.134-12

• https://bugzilla.redhat.com/show_bug.cgi?id=2087760
• https://www.debian.org/security/2022/dsa-5161

• Debian update for linux
• Multiple vulnerabilities in Google Android
• openEuler update for kernel
• Anolis OS update for kernel