CVE-2022-3910
Summary
| CVE | CVE-2022-3910 |
|---|---|
| State | PUBLIC |
| Assigner | [email protected] |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2022-11-22 13:15:00 UTC |
| Updated | 2023-11-07 03:51:00 UTC |
| Description | Use After Free vulnerability in Linux Kernel allows Privilege Escalation. An improper Update of Reference Count in io_uring leads to Use-After-Free and Local Privilege Escalation. When io_msg_ring was invoked with a fixed file, it called io_fput_file() which improperly decreased its reference count (leading to Use-After-Free and Local Privilege Escalation). Fixed files are permanently registered to the ring, and should not be put separately. We recommend upgrading past commit https://github.com/torvalds/linux/commit/fc7222c3a9f56271fba02aabbfbae999042f1679 https://github.com/torvalds/linux/commit/fc7222c3a9f56271fba02aabbfbae999042f1679 |
Risk And Classification
Problem Types: NVD-CWE-Other
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Operating System | Linux | Linux Kernel | All | All | All | All |
| Operating System | Linux | Linux Kernel | 6.0 | rc1 | All | All |
| Operating System | Linux | Linux Kernel | 6.0 | rc2 | All | All |
| Operating System | Linux | Linux Kernel | 6.0 | rc3 | All | All |
| Operating System | Linux | Linux Kernel | 6.0 | rc4 | All | All |
| Operating System | Linux | Linux Kernel | 6.0 | rc5 | All | All |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| ???????? | MISC | kernel.dance | |
| io_uring/msg_ring: check file type before putting · torvalds/linux@fc7222c · GitHub | MISC | github.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
Legacy QID Mappings
- 182270 Debian Security Update for linux (CVE-2022-3910)
- 199089 Ubuntu Security Notification for Linux kernel Vulnerabilities (USN-5793-1)
- 199096 Ubuntu Security Notification for Linux kernel (Azure) Vulnerabilities (USN-5793-2)
- 199098 Ubuntu Security Notification for Linux kernel (IBM) Vulnerabilities (USN-5793-4)
- 199099 Ubuntu Security Notification for Linux kernel Vulnerabilities (USN-5793-3)
- 904513 Common Base Linux Mariner (CBL-Mariner) Security Update for kernel (11462)
- 904514 Common Base Linux Mariner (CBL-Mariner) Security Update for kernel (11460)
- 904718 Common Base Linux Mariner (CBL-Mariner) Security Update for kernel (11460-1)
- 904754 Common Base Linux Mariner (CBL-Mariner) Security Update for kernel (11462-1)
- 906183 Common Base Linux Mariner (CBL-Mariner) Security Update for kernel (11462-2)
- 906446 Common Base Linux Mariner (CBL-Mariner) Security Update for kernel (11460-2)