Use-after-free in Linux kernel - CVE-2022-1973

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU65641

Use-after-free in Linux kernel - CVE-2022-1973

Published: July 21, 2022


Vulnerability identifier: #VU65641
CSH Severity: Low
CVSS v4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2022-1973
CWE-ID: CWE-416
Exploitation vector: Local access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a local user to perform a denial of service attack.

The vulnerability exists due to a use-after-free error within the NTFS file system implementation in the Linux kernel. A local user can trigger a use-after-free error and crash the system or gain access to sensitive information.


Affected software

Linux kernel
Amazon Linux AMI
Slackware Linux
Ubuntu
Fedora
linux-image-lowlatency (Ubuntu package)
linux-image-lowlatency-64k (Ubuntu package)
linux-image-lowlatency-64k-hwe-22.04 (Ubuntu package)
linux-image-lowlatency-hwe-22.04 (Ubuntu package)
linux-image-generic (Ubuntu package)
linux-image-generic-64k (Ubuntu package)
linux-image-generic-64k-hwe-22.04 (Ubuntu package)
linux-image-generic-hwe-22.04 (Ubuntu package)
linux-image-generic-lpae (Ubuntu package)
linux-image-generic-lpae-hwe-22.04 (Ubuntu package)
linux-image-oem-20.04 (Ubuntu package)
linux-image-virtual-hwe-22.04 (Ubuntu package)
linux-image-virtual (Ubuntu package)
linux-image-5.15.0-47-generic-64k (Ubuntu package)
linux-image-5.15.0-47-generic-lpae (Ubuntu package)
linux-image-5.15.0-47-generic (Ubuntu package)
linux-image-5.15.0-47-lowlatency (Ubuntu package)
linux-image-5.15.0-47-lowlatency-64k (Ubuntu package)
linux-image-5.15.0-48-generic (Ubuntu package)
linux-image-5.15.0-48-lowlatency (Ubuntu package)
linux-image-5.15.0-48-generic-lpae (Ubuntu package)
linux-image-5.15.0-48-lowlatency-64k (Ubuntu package)
linux-image-5.15.0-48-generic-64k (Ubuntu package)
linux-image-lowlatency-hwe-20.04 (Ubuntu package)
linux-image-lowlatency-64k-hwe-20.04 (Ubuntu package)
linux-image-generic-hwe-20.04 (Ubuntu package)
linux-image-virtual-hwe-20.04 (Ubuntu package)
linux-image-generic-lpae-hwe-20.04 (Ubuntu package)
linux-image-generic-64k-hwe-20.04 (Ubuntu package)
linux-image-5.15.0-1002-gkeop (Ubuntu package)
linux-image-gkeop (Ubuntu package)
linux-image-gkeop-5.15 (Ubuntu package)
linux-image-ibm (Ubuntu package)
linux-image-5.15.0-1013-ibm (Ubuntu package)
linux-image-raspi-nolpae (Ubuntu package)
linux-image-raspi (Ubuntu package)
linux-image-5.15.0-1014-raspi (Ubuntu package)
linux-image-5.15.0-1014-raspi-nolpae (Ubuntu package)
linux-image-gke (Ubuntu package)
linux-image-gke-5.15 (Ubuntu package)
linux-image-5.15.0-1015-gke (Ubuntu package)
linux-image-5.15.0-1015-intel-iotg (Ubuntu package)
linux-image-oracle (Ubuntu package)
linux-image-kvm (Ubuntu package)
linux-image-gcp (Ubuntu package)
linux-image-5.15.0-1017-kvm (Ubuntu package)
linux-image-5.15.0-1017-oracle (Ubuntu package)
linux-image-5.15.0-1017-gcp (Ubuntu package)
linux-image-azure (Ubuntu package)
linux-image-aws (Ubuntu package)
linux-image-5.15.0-1019-aws (Ubuntu package)
linux-image-5.15.0-1019-azure (Ubuntu package)
linux-5.15.63/kernel-modules
linux-5.15.63/kernel-huge
linux-5.15.63/kernel-headers
linux-5.15.63/kernel-generic
linux-image-oem-22.04a (Ubuntu package)
linux-image-oem-22.04 (Ubuntu package)
linux-image-5.17.0-1013-oem (Ubuntu package)
kernel
linux-image-intel-iotg (Ubuntu package)

How to mitigate CVE-2022-1973

Install updates from vendor's website.

Linux kernel - update to 5.19 rc1
linux-image-lowlatency (Ubuntu package) - update to 5.15.0.47.44
linux-image-lowlatency-64k (Ubuntu package) - update to 5.15.0.47.44
linux-image-lowlatency-64k-hwe-22.04 (Ubuntu package) - update to 5.15.0.47.44
linux-image-lowlatency-hwe-22.04 (Ubuntu package) - update to 5.15.0.47.44
linux-image-generic (Ubuntu package) - update to 5.15.0.47.47
linux-image-generic-64k (Ubuntu package) - update to 5.15.0.47.47
linux-image-generic-64k-hwe-22.04 (Ubuntu package) - update to 5.15.0.47.47
linux-image-generic-hwe-22.04 (Ubuntu package) - update to 5.15.0.47.47
linux-image-generic-lpae (Ubuntu package) - update to 5.15.0.47.47
linux-image-generic-lpae-hwe-22.04 (Ubuntu package) - update to 5.15.0.47.47
linux-image-oem-20.04 (Ubuntu package) - update to 5.15.0.47.47
linux-image-virtual-hwe-22.04 (Ubuntu package) - update to 5.15.0.47.47
linux-image-virtual (Ubuntu package) - update to 5.15.0.47.47
linux-image-5.15.0-47-generic-64k (Ubuntu package) - update to 5.15.0-47.51
linux-image-5.15.0-47-generic-lpae (Ubuntu package) - update to 5.15.0-47.51
linux-image-5.15.0-47-generic (Ubuntu package) - update to 5.15.0-47.51
linux-image-5.15.0-47-lowlatency (Ubuntu package) - update to 5.15.0-47.53
linux-image-5.15.0-47-lowlatency-64k (Ubuntu package) - update to 5.15.0-47.53
linux-image-5.15.0-48-generic (Ubuntu package) - update to 5.15.0-48.54~20.04.1
linux-image-5.15.0-48-lowlatency (Ubuntu package) - update to 5.15.0-48.54~20.04.1
linux-image-5.15.0-48-generic-lpae (Ubuntu package) - update to 5.15.0-48.54~20.04.1
linux-image-5.15.0-48-lowlatency-64k (Ubuntu package) - update to 5.15.0-48.54~20.04.1
linux-image-5.15.0-48-generic-64k (Ubuntu package) - update to 5.15.0-48.54~20.04.1
linux-image-lowlatency-hwe-20.04 (Ubuntu package) - update to 5.15.0.48.54~20.04.16
linux-image-lowlatency-64k-hwe-20.04 (Ubuntu package) - update to 5.15.0.48.54~20.04.16
linux-image-generic-hwe-20.04 (Ubuntu package) - update to 5.15.0.48.54~20.04.18
linux-image-virtual-hwe-20.04 (Ubuntu package) - update to 5.15.0.48.54~20.04.18
linux-image-generic-lpae-hwe-20.04 (Ubuntu package) - update to 5.15.0.48.54~20.04.18
linux-image-generic-64k-hwe-20.04 (Ubuntu package) - update to 5.15.0.48.54~20.04.18
linux-image-5.15.0-1002-gkeop (Ubuntu package) - update to 5.15.0-1002.4
linux-image-gkeop (Ubuntu package) - update to 5.15.0.1002.4
linux-image-gkeop-5.15 (Ubuntu package) - update to 5.15.0.1002.4
linux-image-ibm (Ubuntu package) - update to 5.15.0.1013.12
linux-image-5.15.0-1013-ibm (Ubuntu package) - update to 5.15.0-1013.15
linux-image-raspi-nolpae (Ubuntu package) - update to 5.15.0.1014.13
linux-image-raspi (Ubuntu package) - update to 5.15.0.1014.13
linux-image-5.15.0-1014-raspi (Ubuntu package) - update to 5.15.0-1014.16
linux-image-5.15.0-1014-raspi-nolpae (Ubuntu package) - update to 5.15.0-1014.16
linux-image-intel-iotg (Ubuntu package) - update to 5.15.0.1015.16
linux-image-gke (Ubuntu package) - update to 5.15.0.1015.17
linux-image-gke-5.15 (Ubuntu package) - addressed in versions 5.15.0.1015.17, 5.15.0.1015.18~20.04.1
linux-image-5.15.0-1015-gke (Ubuntu package) - addressed in versions 5.15.0-1015.18, 5.15.0-1015.18~20.04.1
linux-image-5.15.0-1015-intel-iotg (Ubuntu package) - update to 5.15.0-1015.20
linux-image-oracle (Ubuntu package) - update to 5.15.0.1017.15
linux-image-kvm (Ubuntu package) - update to 5.15.0.1017.15
linux-image-gcp (Ubuntu package) - addressed in versions 5.15.0.1017.15, 5.15.0.1017.23~20.04.1
linux-image-5.15.0-1017-kvm (Ubuntu package) - update to 5.15.0-1017.21
linux-image-5.15.0-1017-oracle (Ubuntu package) - update to 5.15.0-1017.22
linux-image-5.15.0-1017-gcp (Ubuntu package) - addressed in versions 5.15.0-1017.23, 5.15.0-1017.23~20.04.2
linux-image-azure (Ubuntu package) - addressed in versions 5.15.0.1019.18, 5.15.0.1019.22~20.04.12
linux-image-aws (Ubuntu package) - addressed in versions 5.15.0.1019.19, 5.15.0.1019.23~20.04.11
linux-image-5.15.0-1019-aws (Ubuntu package) - addressed in versions 5.15.0-1019.23, 5.15.0-1019.23~20.04.1
linux-image-5.15.0-1019-azure (Ubuntu package) - addressed in versions 5.15.0-1019.24, 5.15.0-1019.24~20.04.1
linux-5.15.63/kernel-modules - update to 5.15.63
linux-5.15.63/kernel-huge - update to 5.15.63
linux-5.15.63/kernel-headers - update to 5.15.63
linux-5.15.63/kernel-generic - update to 5.15.63
linux-image-oem-22.04a (Ubuntu package) - update to 5.17.0.1013.12
linux-image-oem-22.04 (Ubuntu package) - update to 5.17.0.1013.12
linux-image-5.17.0-1013-oem (Ubuntu package) - update to 5.17.0-1013.14
kernel - addressed in versions 5.17.14-200.fc35, 5.17.14-300.fc36
kernel - update to 6.1.10-15.42

External References

Related Security Bulletins