CVE-2022-49413

Summary

CVE-2022-49413 is a vulnerability affecting the Linux kernel. It involves the BFQ (Budget Fair Queuing) scheduler, where the function bfq_merge_bio() can merge I/O bios with stale cgroup information. This issue arises when a process is migrated to a different cgroup or when writeback starts submitting bios associated with a different cgroup. Consequently, bios can be merged to requests from different cgroups or merged bfqqs of already dead cgroups, potentially resulting in use-after-free issues. The vulnerability has been addressed by updating cgroup information within the bfq_merge_bio() function.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.