CVE-2022-48854

net: arc_emac: Fix use after free in arc_mdio_probe()

published July 16, 2024

CVSS
—
EPSS
0%
Percentile
9.6
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

net: arc_emac: Fix use after free in arc_mdio_probe()

If bus->state is equal to MDIOBUS_ALLOCATED, mdiobus_free(bus) will free

the "bus". But bus->name is still used in the next line, which will lead

to a use after free.

We can fix it by putting the name in a local variable and make the

bus->name point to the rodata section "name",then use the name in the

error message without referring to bus to avoid the uaf.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00202 · 9.6th percentile
Published
2024-07-16T12:25Z
EPSS history
Timeline
  • 16 JUL 12:25Z
    net: arc_emac: Fix use after free in arc_mdio_probe()
    cvelistv5