CVE-2022-50072 (GCVE-0-2022-50072)
Vulnerability from cvelistv5
Published
2025-06-18 11:02
Modified
2025-06-18 11:02
Severity ?
Summary
In the Linux kernel, the following vulnerability has been resolved: NFSv4/pnfs: Fix a use-after-free bug in open If someone cancels the open RPC call, then we must not try to free either the open slot or the layoutget operation arguments, since they are likely still in use by the hung RPC call.
References
Impacted products
Vendor Product Version
Linux Linux Version: 6b3fc1496e7227cd6a39a80bbfb7588ef7c7a010
Version: a2b3be930e79cc5d9d829f158e31172b2043f0cd
Version: 0ee5b9644f06b4d3cdcd9544f43f63312e425a4c
Version: d4c2a041ed3ba114502d5ed6ace5b1a48d637a8e
Version: 6949493884fe88500de4af182588e071cf1544ee
Version: 6949493884fe88500de4af182588e071cf1544ee
Version: 08d7a26d115cc7892668baa9750f64bd8baca29b
Version: ea759ae0a9ae5acee677d722129710ac89cc59c1
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/nfs/nfs4proc.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "0fffb46ff3d5ed4668aca96441ec7a25b793bd6f",
              "status": "affected",
              "version": "6b3fc1496e7227cd6a39a80bbfb7588ef7c7a010",
              "versionType": "git"
            },
            {
              "lessThan": "f7ee3b772d9de87387a725caa04bc041ac7fe5ec",
              "status": "affected",
              "version": "a2b3be930e79cc5d9d829f158e31172b2043f0cd",
              "versionType": "git"
            },
            {
              "lessThan": "76ffd2042438769298f34b76102b40dea89de616",
              "status": "affected",
              "version": "0ee5b9644f06b4d3cdcd9544f43f63312e425a4c",
              "versionType": "git"
            },
            {
              "lessThan": "a4cf3dadd1fa43609f7c6570c9116b0e0a9923d1",
              "status": "affected",
              "version": "d4c2a041ed3ba114502d5ed6ace5b1a48d637a8e",
              "versionType": "git"
            },
            {
              "lessThan": "b03d1117e9be7c7da60e466eaf9beed85c5916c8",
              "status": "affected",
              "version": "6949493884fe88500de4af182588e071cf1544ee",
              "versionType": "git"
            },
            {
              "lessThan": "2135e5d56278ffdb1c2e6d325dc6b87f669b9dac",
              "status": "affected",
              "version": "6949493884fe88500de4af182588e071cf1544ee",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "08d7a26d115cc7892668baa9750f64bd8baca29b",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "ea759ae0a9ae5acee677d722129710ac89cc59c1",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/nfs/nfs4proc.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.19"
            },
            {
              "lessThan": "5.19",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.19.*",
              "status": "unaffected",
              "version": "4.19.256",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.211",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.138",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.63",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.19.*",
              "status": "unaffected",
              "version": "5.19.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.0",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.19.256",
                  "versionStartIncluding": "4.19.247",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.211",
                  "versionStartIncluding": "5.4.198",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.138",
                  "versionStartIncluding": "5.10.122",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.63",
                  "versionStartIncluding": "5.15.47",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.19.4",
                  "versionStartIncluding": "5.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.0",
                  "versionStartIncluding": "5.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.17.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.18.4",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nNFSv4/pnfs: Fix a use-after-free bug in open\n\nIf someone cancels the open RPC call, then we must not try to free\neither the open slot or the layoutget operation arguments, since they\nare likely still in use by the hung RPC call."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-06-18T11:02:16.658Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/0fffb46ff3d5ed4668aca96441ec7a25b793bd6f"
        },
        {
          "url": "https://git.kernel.org/stable/c/f7ee3b772d9de87387a725caa04bc041ac7fe5ec"
        },
        {
          "url": "https://git.kernel.org/stable/c/76ffd2042438769298f34b76102b40dea89de616"
        },
        {
          "url": "https://git.kernel.org/stable/c/a4cf3dadd1fa43609f7c6570c9116b0e0a9923d1"
        },
        {
          "url": "https://git.kernel.org/stable/c/b03d1117e9be7c7da60e466eaf9beed85c5916c8"
        },
        {
          "url": "https://git.kernel.org/stable/c/2135e5d56278ffdb1c2e6d325dc6b87f669b9dac"
        }
      ],
      "title": "NFSv4/pnfs: Fix a use-after-free bug in open",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2022-50072",
    "datePublished": "2025-06-18T11:02:16.658Z",
    "dateReserved": "2025-06-18T10:57:27.407Z",
    "dateUpdated": "2025-06-18T11:02:16.658Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2022-50072\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-06-18T11:15:36.057\",\"lastModified\":\"2025-06-18T13:47:40.833\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nNFSv4/pnfs: Fix a use-after-free bug in open\\n\\nIf someone cancels the open RPC call, then we must not try to free\\neither the open slot or the layoutget operation arguments, since they\\nare likely still in use by the hung RPC call.\"}],\"metrics\":{},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/0fffb46ff3d5ed4668aca96441ec7a25b793bd6f\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/2135e5d56278ffdb1c2e6d325dc6b87f669b9dac\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/76ffd2042438769298f34b76102b40dea89de616\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/a4cf3dadd1fa43609f7c6570c9116b0e0a9923d1\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/b03d1117e9be7c7da60e466eaf9beed85c5916c8\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/f7ee3b772d9de87387a725caa04bc041ac7fe5ec\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}"
  }
}