CVE-2022-4696: linux linux_kernel Release of Invalid Pointer or Reference

Vulnerability summary

CVE-2022-4696 is a high (CVSS 7.8) Release of Invalid Pointer or Reference vulnerability in linux linux_kernel. EPSS estimates a 0.43% chance of exploitation in the next 30 days, higher than 36% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 11-01-2023
   PublishedVulnerability first disclosed.
2. 03-08-2024
   Last modifiedVulnerability information updated.

Description

There exists a use-after-free vulnerability in the Linux kernel through io_uring and the IORING_OP_SPLICE operation. If IORING_OP_SPLICE is missing the IO_WQ_WORK_FILES flag, which signals that the operation won't use current->nsproxy, so its reference counter is not increased. This assumption is not always true as calling io_splice on specific files will call the get_uts function which will use current->nsproxy leading to invalidly decreasing its reference counter later causing the use-after-free vulnerability. We recommend upgrading to version 5.10.160 or above

• CWE-763Release of Invalid Pointer or ReferenceThe product attempts to return a memory resource to the system, but it calls the wrong release function or calls the appropriate release function incorrectly.
• CWE-416Use After FreeThe product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.