CVE-2022-48771
drm/vmwgfx: Fix stale file descriptors on failed usercopy
HIGH 7.8
At a glance
- Source
- NVD
- EPSS
- EPSS 0.21 % · percentile 12 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- Linux
- NVD status
- Modified
Description
In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: Fix stale file descriptors on failed usercopy A failing usercopy of the fence_rep object will lead to a stale entry in the file descriptor table as put_unused_fd() won't release it. This enables userland to refer to a dangling 'file' object through that still valid file descriptor, leading to all kinds of use-after-free exploitation scenarios. Fix this by deferring the call to fd_install() until after the usercopy has succeeded.
Weaknesses (CWE)
- CWE-416 — Use After Free
References
- https://git.kernel.org/stable/c/e8d092a62449dcfc73517ca43963d2b8f44d0516
- https://git.kernel.org/stable/c/0008a0c78fc33a84e2212a7c04e6b21a36ca6f4d
- https://git.kernel.org/stable/c/84b1259fe36ae0915f3d6ddcea6377779de48b82
- https://git.kernel.org/stable/c/ae2b20f27732fe92055d9e7b350abc5cdf3e2414
- https://git.kernel.org/stable/c/6066977961fc6f437bc064f628cf9b0e4571c56c
- https://git.kernel.org/stable/c/1d833b27fb708d6fdf5de9f6b3a8be4bd4321565
- https://git.kernel.org/stable/c/a0f90c8815706981c483a652a6aefca51a5e191c
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | HIGH 7.8 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H | Linux |
| CVSS 3.1 | HIGH 7.8 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H | NVD · 416baaa9-dc9f-4396-8d5f-8c081fb06d67 (Secondary) |
| CVSS 3.1 | HIGH 7.8 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H | NVD · nvd@nist.gov (Primary) |
European references
- ENISA EUVD · EUVD-2022-53650
- GCVE · GCVE-0-2022-48771
CERT-FR advisories
- CERTFR-2026-AVI-0326 — Multiples vulnérabilités dans les produits VMware · cert.ssi.gouv.fr
- CERTFR-2026-AVI-0316 — Multiples vulnérabilités dans les produits VMware · cert.ssi.gouv.fr
- CERTFR-2024-AVI-0693 — Multiples vulnérabilités dans le noyau Linux de SUSE · cert.ssi.gouv.fr
- CERTFR-2024-AVI-0610 — Multiples vulnérabilités dans le noyau Linux de SUSE · cert.ssi.gouv.fr
- CERTFR-2024-AVI-0578 — Multiples vulnérabilités dans le noyau Linux de SUSE · cert.ssi.gouv.fr
Affected configurations (NVD CPE)
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 4.14 < 4.14.264cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 4.15 < 4.19.227cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 4.20 < 5.4.175cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 5.5 < 5.10.95cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 5.11 < 5.15.18cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 5.16 < 5.16.4cpe:2.3:o:linux:linux_kernel:5.17:rc1:*:*:*:*:*:*
Affected products
| Product | Versions |
|---|---|
| Linux · Linux | affected c906965dee22d5e95d0651759ba107b420212a9f < e8d092a62449dcfc73517ca43963d2b8f44d0516 ; affected c906965dee22d5e95d0651759ba107b420212a9f < 0008a0c78fc33a84e2212a7c04e6b21a36ca6f4d ; affected c906965dee22d5e95d0651759ba107b420212a9f < 84b1259fe36ae0915f3d6ddcea6377779de48b82 ; affected c906965dee22d5e95d0651759ba107b420212a9f < ae2b20f27732fe92055d9e7b350abc5cdf3e2414 ; affected c906965dee22d5e95d0651759ba107b420212a9f < 6066977961fc6f437bc064f628cf9b0e4571c56c ; affected c906965dee22d5e95d0651759ba107b420212a9f < 1d833b27fb708d6fdf5de9f6b3a8be4bd4321565 |
| Linux · Linux | affected 4.14 ; unaffected 0 < 4.14 ; unaffected 4.14.264 ≤ 4.14.* ; unaffected 4.19.227 ≤ 4.19.* ; unaffected 5.4.175 ≤ 5.4.* ; unaffected 5.10.95 ≤ 5.10.* |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |