CVE-2022-49085

Summary

CVE-2022-49085: A vulnerability was discovered in the Linux kernel's drbd module. In the function get_initial_state, if notify_initial_state_done fails and frees the skb (Socket Buffer), the freed skb is later used in the return value, resulting in a use-after-free (UAF) bug. Worse still, skb can also be freed in the notify_*_state_change calls below, causing an additional four UAF bugs. The patch released for this vulnerability allows notify_initial_state_done and notify_*_state_calls to return an error code instead, preventing the UAF bugs. The patch also resolved a compilation warning present in version 2.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.