CVE-2022-48821

See a problem?
Please try reporting it to the source first.
Source
https://nvd.nist.gov/vuln/detail/CVE-2022-48821
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2022-48821.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2022-48821
Downstream
Related
Published
2024-07-16T12:15:06Z
Modified
2025-09-25T19:36:51Z
Severity
  • 7.8 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
[none]
Details

In the Linux kernel, the following vulnerability has been resolved:

misc: fastrpc: avoid double fput() on failed usercopy

If the copy back to userland fails for the FASTRPCIOCTLALLOCDMABUFF ioctl(), we shouldn't assume that 'buf->dmabuf' is still valid. In fact, dmabuffd() called fd_install() before, i.e. "consumed" one reference, leaving us with none.

Calling dmabufput() will therefore put a reference we no longer own, leading to a valid file descritor table entry for an already released 'file' object which is a straight use-after-free.

Simply avoid calling dmabufput() and rely on the process exit code to do the necessary cleanup, if needed, i.e. if the file descriptor is still valid.

References

Affected packages