Vulnerability · Published Jan 11, 2023 · Assigned by Google
CVE-2022-4696
High 7.8
In plain English
A high-severity security flaw in Linux Kernel from Linux. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 38% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
There exists a use-after-free vulnerability in the Linux kernel through io_uring and the IORING_OP_SPLICE operation. If IORING_OP_SPLICE is missing the IO_WQ_WORK_FILES flag, which signals that the operation won't use current->nsproxy, so its reference counter is not increased. This assumption is not always true as calling io_splice on specific files will call the get_uts function which will use current->nsproxy leading to invalidly decreasing its reference counter later causing the use-after-free vulnerability. We recommend upgrading to version 5.10.160 or above
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | linux | 5.14.6-1 | DEBIAN-CVE-2022-4696 |
| Debian:13 | linux | 5.14.6-1 | DEBIAN-CVE-2022-4696 |
| Debian:14 | linux | 5.14.6-1 | DEBIAN-CVE-2022-4696 |
| Ubuntu:22.04:LTS | linux-riscv | no fix listed | UBUNTU-CVE-2022-4696 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Linux | Linux Kernel | 5.7-rc1 – through 5.10.159 |
Weakness: CWE-763 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H