CVE-2022-48861

vdpa: fix use-after-free on vp_vdpa_remove

published July 16, 2024

CVSS
—
EPSS
0%
Percentile
9.8
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

vdpa: fix use-after-free on vp_vdpa_remove

When vp_vdpa driver is unbind, vp_vdpa is freed in vdpa_unregister_device

and then vp_vdpa->mdev.pci_dev is dereferenced in vp_modern_remove,

triggering use-after-free.

Call Trace of unbinding driver free vp_vdpa :

do_syscall_64

vfs_write

kernfs_fop_write_iter

device_release_driver_internal

pci_device_remove

vp_vdpa_remove

vdpa_unregister_device

kobject_release

device_release

kfree

Call Trace of dereference vp_vdpa->mdev.pci_dev:

vp_modern_remove

pci_release_selected_regions

pci_release_region

pci_resource_len

pci_resource_end

(dev)->resource[(bar)].end

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00203 · 9.8th percentile
Published
2024-07-16T12:25Z
EPSS history
Timeline
  • 16 JUL 12:25Z
    vdpa: fix use-after-free on vp_vdpa_remove
    cvelistv5