CVE-2022-49258

Summary

CVE-2022-49258 is a use-after-free vulnerability affecting the Linux kernel crypto module, specifically in the ccree subsystem. In the function cc_cipher_exit(), the memory pointed to by ctx_p->user.key is freed using kfree_sensitive(), but this memory is still in use in the subsequent line, leading to a use-after-free condition. To mitigate this issue, kfree_sensitive() should be called before using dev_dbg().

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.