CVE-2022-49025CWE-416

CVE-2022-49025

High · published October 22, 2024

CVSS v3.1
7.8
EPSS
0%
Percentile
15.2
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

net/mlx5e: Fix use-after-free when reverting termination table

When having multiple dests with termination tables and second one

or afterwards fails the driver reverts usage of term tables but

doesn't reset the assignment in attr->dests[num_vport_dests].termtbl

which case a use-after-free when releasing the rule.

Fix by resetting the assignment of termtbl to null.

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00248 · 15.2th percentile
Weakness
CWE-416 · Use After Free
Published
2024-10-22T00:15Z
Affected products (11)
ProductVersionsFixed in
linux/linux_kernel≥ 5.3, < 5.4.2265.4.226
linux/linux_kernel≥ 5.5, < 5.10.1585.10.158
linux/linux_kernel≥ 5.11, < 5.15.825.15.82
linux/linux_kernel≥ 5.16, < 6.0.126.0.12
linux/linux_kernelall versions—
linux/linux_kernelall versions—
linux/linux_kernelall versions—
linux/linux_kernelall versions—
linux/linux_kernelall versions—
linux/linux_kernelall versions—
linux/linux_kernelall versions—
References (5)
https://git.kernel.org/stable/c/0a2d73a77060c3cbdc6e801cd5d979d674cd404b · 416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/0d2f9d95d9fbe993f3c4bafb87d59897b0325aff · 416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/372eb550faa0757349040fd43f59483cbfdb2c0b · 416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/52c795af04441d76f565c4634f893e5b553df2ae · 416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/e6d2d26a49c3a9cd46b232975e45236304810904 · 416baaa9-dc9f-4396-8d5f-8c081fb06d67
EPSS history
Timeline
  • 21 OCT 20:06Z
    net/mlx5e: Fix use-after-free when reverting termination table
    cvelistv5