CVE-2022-49385

Source
https://cve.org/CVERecord?id=CVE-2022-49385
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2022-49385.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2022-49385
Downstream
Related
Published
2025-02-26T02:11:20.725Z
Modified
2026-04-11T12:43:57.830904Z
Severity
  • 7.8 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
driver: base: fix UAF when driver_attach failed
Details

In the Linux kernel, the following vulnerability has been resolved:

driver: base: fix UAF when driver_attach failed

When driverattach(drv); failed, the driverprivate will be freed. But it has been added to the bus, which caused a UAF.

To fix it, we need to delete it from the bus when failed.

Database specific
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/49xxx/CVE-2022-49385.json",
    "cna_assigner": "Linux"
}
References

Affected packages

Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

Affected ranges

Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
190888ac01d059e38ffe77a2291d44cafa9016fb
Fixed
5d709f58c743166fe1c6914b9de0ae8868600d9b
Fixed
823f24f2e329babd0330200d0b74882516fe57f4
Fixed
cdf1a683a01583bca4b618dd16223cbd6e462e21
Fixed
5389101257828d1913d713d9a40acbe14f5961df
Fixed
c059665c84feab46b7173d3a1bf36c2fb7f9df86
Fixed
310862e574001a97ad02272bac0fd13f75f42a27

Database specific

source
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2022-49385.json"

Linux / Kernel

Package

Name
Kernel

Affected ranges

Type
ECOSYSTEM
Events
Introduced
3.9.0
Fixed
5.4.198
Type
ECOSYSTEM
Events
Introduced
5.5.0
Fixed
5.10.122
Type
ECOSYSTEM
Events
Introduced
5.11.0
Fixed
5.15.47
Type
ECOSYSTEM
Events
Introduced
5.16.0
Fixed
5.17.15
Type
ECOSYSTEM
Events
Introduced
5.18.0
Fixed
5.18.4

Database specific

source
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2022-49385.json"