FKIE_CVE-2022-49388

Vulnerability from fkie_nvd - Published: 2025-02-26 07:01 - Updated: 2026-06-17 05:17
Severity
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Summary
In the Linux kernel, the following vulnerability has been resolved: ubi: ubi_create_volume: Fix use-after-free when volume creation failed There is an use-after-free problem for 'eba_tbl' in ubi_create_volume()'s error handling path: ubi_eba_replace_table(vol, eba_tbl) vol->eba_tbl = tbl out_mapping: ubi_eba_destroy_table(eba_tbl) // Free 'eba_tbl' out_unlock: put_device(&vol->dev) vol_release kfree(tbl->entries) // UAF Fix it by removing redundant 'eba_tbl' releasing. Fetch a reproducer in [Link].
References
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/1174ab8ba36a48025b68b5ff1085000b1e510217Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/25ff1e3a1351c0d936dd1ac2f9e58231ea1510c9Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/5ff2514e4fb55dcf3d88294686040ca73ea0c1a2Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/6d8d3f68cbecfd31925796f0fb668eb21ab06734Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/8302620aeb940f386817321d272b12411ae7d39fPatch
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/8c03a1c21d72210f81cb369cc528e3fde4b45411Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/abb67043060f2bf4c03d7c3debb9ae980e2b6db3Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/e27ecf325e51abd06aaefba57a6322a46fa4178bPatch
Impacted products
Vendor Product Version
linux linux_kernel *
linux linux_kernel *
linux linux_kernel *
linux linux_kernel *
linux linux_kernel *
linux linux_kernel *
linux linux_kernel *
To clipboard 

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/mtd/ubi/vmt.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "25ff1e3a1351c0d936dd1ac2f9e58231ea1510c9",
              "status": "affected",
              "version": "493cfaeaa0c9bc0c79ce5751193d49fdac9aaaec",
              "versionType": "git"
            },
            {
              "lessThan": "abb67043060f2bf4c03d7c3debb9ae980e2b6db3",
              "status": "affected",
              "version": "493cfaeaa0c9bc0c79ce5751193d49fdac9aaaec",
              "versionType": "git"
            },
            {
              "lessThan": "8302620aeb940f386817321d272b12411ae7d39f",
              "status": "affected",
              "version": "493cfaeaa0c9bc0c79ce5751193d49fdac9aaaec",
              "versionType": "git"
            },
            {
              "lessThan": "6d8d3f68cbecfd31925796f0fb668eb21ab06734",
              "status": "affected",
              "version": "493cfaeaa0c9bc0c79ce5751193d49fdac9aaaec",
              "versionType": "git"
            },
            {
              "lessThan": "5ff2514e4fb55dcf3d88294686040ca73ea0c1a2",
              "status": "affected",
              "version": "493cfaeaa0c9bc0c79ce5751193d49fdac9aaaec",
              "versionType": "git"
            },
            {
              "lessThan": "e27ecf325e51abd06aaefba57a6322a46fa4178b",
              "status": "affected",
              "version": "493cfaeaa0c9bc0c79ce5751193d49fdac9aaaec",
              "versionType": "git"
            },
            {
              "lessThan": "1174ab8ba36a48025b68b5ff1085000b1e510217",
              "status": "affected",
              "version": "493cfaeaa0c9bc0c79ce5751193d49fdac9aaaec",
              "versionType": "git"
            },
            {
              "lessThan": "8c03a1c21d72210f81cb369cc528e3fde4b45411",
              "status": "affected",
              "version": "493cfaeaa0c9bc0c79ce5751193d49fdac9aaaec",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/mtd/ubi/vmt.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.12"
            },
            {
              "lessThan": "4.12",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.14.*",
              "status": "unaffected",
              "version": "4.14.283",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.19.*",
              "status": "unaffected",
              "version": "4.19.247",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.198",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.122",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.47",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.17.*",
              "status": "unaffected",
              "version": "5.17.15",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.18.*",
              "status": "unaffected",
              "version": "5.18.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "5.19",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "C1826012-E991-4F57-B5A8-B3B6949796C0",
              "versionEndExcluding": "4.14.283",
              "versionStartIncluding": "4.12",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "B8CFA0F4-2D75-41F4-9753-87944A08B53B",
              "versionEndExcluding": "4.19.247",
              "versionStartIncluding": "4.15",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "3EC49633-14DE-4EBD-BB80-76AE2E3EABB9",
              "versionEndExcluding": "5.4.198",
              "versionStartIncluding": "4.20",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "1B42AA01-44D8-4572-95E6-FF8E374CF9C5",
              "versionEndExcluding": "5.10.122",
              "versionStartIncluding": "5.5",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "FC042EE3-4864-4325-BE0B-4BCDBF11AA61",
              "versionEndExcluding": "5.15.47",
              "versionStartIncluding": "5.11",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "53E7AA2E-2FB4-45CA-A22B-08B4EDBB51AD",
              "versionEndExcluding": "5.17.15",
              "versionStartIncluding": "5.16",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "FA6D643C-6D6A-4821-8A8D-B5776B8F0103",
              "versionEndExcluding": "5.18.4",
              "versionStartIncluding": "5.18",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nubi: ubi_create_volume: Fix use-after-free when volume creation failed\n\nThere is an use-after-free problem for \u0027eba_tbl\u0027 in ubi_create_volume()\u0027s\nerror handling path:\n\n  ubi_eba_replace_table(vol, eba_tbl)\n    vol-\u003eeba_tbl = tbl\nout_mapping:\n  ubi_eba_destroy_table(eba_tbl)   // Free \u0027eba_tbl\u0027\nout_unlock:\n  put_device(\u0026vol-\u003edev)\n    vol_release\n      kfree(tbl-\u003eentries)\t  // UAF\n\nFix it by removing redundant \u0027eba_tbl\u0027 releasing.\nFetch a reproducer in [Link]."
    },
    {
      "lang": "es",
      "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: ubi: ubi_create_volume: Se corrige el problema de use-after-free cuando falla la creaci\u00f3n del volumen Hay un problema de use-after-free para \u0027eba_tbl\u0027 en la ruta de gesti\u00f3n de errores de ubi_create_volume(): ubi_eba_replace_table(vol, eba_tbl) vol-\u0026gt;eba_tbl = tbl out_mapping: ubi_eba_destroy_table(eba_tbl) // Libera \u0027eba_tbl\u0027 out_unlock: put_device(\u0026amp;vol-\u0026gt;dev) vol_release kfree(tbl-\u0026gt;entries) // UAF Arr\u00e9glalo eliminando la liberaci\u00f3n redundante de \u0027eba_tbl\u0027. Obt\u00e9n un reproductor en [Enlace]."
    }
  ],
  "id": "CVE-2022-49388",
  "lastModified": "2026-06-17T05:17:54.427",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "LOCAL",
          "availabilityImpact": "HIGH",
          "baseScore": 7.8,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 5.9,
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2022-49388",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2025-02-27T17:58:38.126339Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2025-02-26T07:01:15.430",
  "references": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/1174ab8ba36a48025b68b5ff1085000b1e510217"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/25ff1e3a1351c0d936dd1ac2f9e58231ea1510c9"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/5ff2514e4fb55dcf3d88294686040ca73ea0c1a2"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/6d8d3f68cbecfd31925796f0fb668eb21ab06734"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/8302620aeb940f386817321d272b12411ae7d39f"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/8c03a1c21d72210f81cb369cc528e3fde4b45411"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/abb67043060f2bf4c03d7c3debb9ae980e2b6db3"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/e27ecf325e51abd06aaefba57a6322a46fa4178b"
    }
  ],
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-416"
        }
      ],
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "type": "Secondary"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.