by Kastro
Paper/Archive/CVE-2022-49362

CVE-2022-49362

Linux Linux — NFSD: Fix potential use-after-free in nfsd_file_put()

EPSS 0.7%CVSS 9.8
critical.is priorityof 100
40
CVSS 9.8 (CNA)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 51.4.514 × 2010.3No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

In the Linux kernel, the following vulnerability has been resolved: NFSD: Fix potential use-after-free in nfsd_file_put() nfsd_file_put_noref() can free @nf, so don't dereference @nf immediately upon return from nfsd_file_put_noref().

Affected

ProductAffectedFixed inSource
Linux9862064ca81f9b9da8ebe26c86cf2b10c293ba1a – < ada1757b259f353cade47037ee0a0249b4cddad3ada1757b259f353cade47037ee0a0249b4cddad3CNA
Linuxa98e5b3d958ac697aafb3d077eb2cca4a731b7ee – < 261eabe19cb28e4a8587a4442d257b543d7c2d57261eabe19cb28e4a8587a4442d257b543d7c2d57CNA
Linux999397926ab3f78c7d1235cc4ca6e3c89d2769bf – < 333dcc94ebf53f79f3dc0e7a7c16700bc7ff7e57333dcc94ebf53f79f3dc0e7a7c16700bc7ff7e57CNA
Linux999397926ab3f78c7d1235cc4ca6e3c89d2769bf – < b6c71c66b0ad8f2b59d9bc08c7a5079b110bec01b6c71c66b0ad8f2b59d9bc08c7a5079b110bec01CNA
Linux5.185.18.4CNA

Scores by source

Linux (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADP7.8CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

refgit.kernel.org/stable/c/ada1757b259f353cade47037ee0a0249b4cddad3refgit.kernel.org/stable/c/261eabe19cb28e4a8587a4442d257b543d7c2d57refgit.kernel.org/stable/c/333dcc94ebf53f79f3dc0e7a7c16700bc7ff7e57refgit.kernel.org/stable/c/b6c71c66b0ad8f2b59d9bc08c7a5079b110bec01