CVE-2022-49093

Summary

CVE-2022-49093 is a use-after-free vulnerability in the Linux kernel. This issue affects the handling of page_pool fragments during RX processing in the hns3 driver. In certain conditions, a page reference is dropped twice when coalescing two SKBs (SKB2 and SKB3), leaving the third RX descriptor still referencing the freed page (PAGE2), leading to potential IOMMU faults or silent memory corruption. The vulnerability was due to the incorrect release of page references during coalescing and has been resolved by updating the logic to prevent coalescing of cloned pp_recycled SKBs into page refcounted ones.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.