CVE-2022-49770

In the Linux kernel, the following vulnerability has been resolved: ceph: avoid putting the realm twice when decoding snaps fails When decoding the snaps fails it maybe leaving the 'first_realm' and 'realm' pointing to the same snaprealm memory. And then it'll put it twice and could cause random use-after-free, BUG_ON, etc issues.

CVSS v3 7.8 HIGH

7.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://git.kernel.org/stable/c/044bc6d3c2c0e9090b0841e7b723875756534b45	Patch
https://git.kernel.org/stable/c/274e4c79a3a2a24fba7cfe0e41113f1138785c37	Patch
https://git.kernel.org/stable/c/2f6e2de3a5289004650118b61f138fe7c28e1905	Patch
https://git.kernel.org/stable/c/51884d153f7ec85e18d607b2467820a90e0f4359	Patch
https://git.kernel.org/stable/c/cb7495fe957526555782ce0723f79ce92a6db22e	Patch
https://git.kernel.org/stable/c/fd879c83e87735ab8f00ef7755752cf0cbae24b2	Patch

Configurations

Configuration 1 (hide)

OR	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel:2.6.34:-::::::
	cpe:2.3:o:linux:linux_kernel:2.6.34:rc2::::::
	cpe:2.3:o:linux:linux_kernel:2.6.34:rc3::::::
	cpe:2.3:o:linux:linux_kernel:2.6.34:rc4::::::
	cpe:2.3:o:linux:linux_kernel:2.6.34:rc5::::::
	cpe:2.3:o:linux:linux_kernel:2.6.34:rc6::::::
	cpe:2.3:o:linux:linux_kernel:2.6.34:rc7::::::
	cpe:2.3:o:linux:linux_kernel:6.1:rc1::::::
	cpe:2.3:o:linux:linux_kernel:6.1:rc2::::::
	cpe:2.3:o:linux:linux_kernel:6.1:rc3::::::
	cpe:2.3:o:linux:linux_kernel:6.1:rc4::::::
	cpe:2.3:o:linux:linux_kernel:6.1:rc5::::::

History

No history.

Information

Published : 2025-05-01 15:15

Updated : 2025-11-06 21:45

NVD link : CVE-2022-49770

Mitre link : CVE-2022-49770

CVE.ORG link : CVE-2022-49770

JSON object : View

Products Affected

linux

linux_kernel

CWE

CWE-416

Use After Free

{"id": "CVE-2022-49770", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.8}]}, "published": "2025-05-01T15:15:59.920", "references": [{"url": "https://git.kernel.org/stable/c/044bc6d3c2c0e9090b0841e7b723875756534b45", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/274e4c79a3a2a24fba7cfe0e41113f1138785c37", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/2f6e2de3a5289004650118b61f138fe7c28e1905", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/51884d153f7ec85e18d607b2467820a90e0f4359", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/cb7495fe957526555782ce0723f79ce92a6db22e", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/fd879c83e87735ab8f00ef7755752cf0cbae24b2", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-416"}]}], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nceph: avoid putting the realm twice when decoding snaps fails\n\nWhen decoding the snaps fails it maybe leaving the 'first_realm'\nand 'realm' pointing to the same snaprealm memory. And then it'll\nput it twice and could cause random use-after-free, BUG_ON, etc\nissues."}, {"lang": "es", "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: ceph: evita repetir el dominio cuando falla la decodificaci\u00f3n de snaps. Al fallar la decodificaci\u00f3n de snaps, puede que \"first_realm\" y \"realm\" apunten a la misma memoria de snaprealm. En ese caso, lo repetir\u00e1, lo que podr\u00eda causar problemas aleatorios de use-after-free, BUG_ON, etc."}], "lastModified": "2025-11-06T21:45:48.500", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0EDF5BF7-F16B-4246-879A-2952C0D0140F", "versionEndExcluding": "4.19.268", "versionStartIncluding": "2.6.35"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "274F5087-5805-4D03-8C74-8517300658F1", "versionEndExcluding": "5.4.226", "versionStartIncluding": "4.20"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "5EAF291E-0C2B-409D-9D82-59F0C0B67CAB", "versionEndExcluding": "5.10.157", "versionStartIncluding": "5.5"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "899FBA32-27B2-4660-BC94-C43ED4349EB5", "versionEndExcluding": "5.15.81", "versionStartIncluding": "5.11"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "64F9ADD1-3ADB-4D66-A00F-4A83010B05F0", "versionEndExcluding": "6.0.10", "versionStartIncluding": "5.16"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:2.6.34:-:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A3B1BC1D-ED46-4364-A1D9-1FA74182B03A"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:2.6.34:rc2:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "86D3F64C-3F27-43E0-B0D4-62CE1E1F4EFB"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:2.6.34:rc3:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "7927713B-5EB0-41EB-86A9-9935775162E0"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:2.6.34:rc4:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "59037296-3143-4FBB-AFF7-D4FE2C85502F"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:2.6.34:rc5:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9CA27FD5-7DBF-4C85-80A9-D523B2E4B033"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:2.6.34:rc6:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9711E333-A8E7-4F4B-BCFD-2023E889651A"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:2.6.34:rc7:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E04D3358-973B-42A1-8E08-2E3AE947193C"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.1:rc1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E7E331DA-1FB0-4DEC-91AC-7DA69D461C11"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.1:rc2:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "17F0B248-42CF-4AE6-A469-BB1BAE7F4705"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.1:rc3:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E2422816-0C14-4B5E-A1E6-A9D776E5C49B"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.1:rc4:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1C6E00FE-5FB9-4D20-A1A1-5A32128F9B76"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.1:rc5:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "35B26BE4-43A6-4A36-A7F6-5B3F572D9186"}], "operator": "OR"}]}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}