CVE-2022-49465

Summary

CVE-2022-49465: A vulnerability was identified in the Linux kernel's blk-throttle subsystem. When a bio (Buffer I/O control structure) is throttled, it sets the BIO_THROTTLED flag to the bio object immediately after __blk_throtl_bio(). However, if the bio is throttled and submitted for processing before being completed, it may result in use-after-free when the BIO_THROTTLED flag is set. This issue was discovered by the Kernel Address Sanitizer (KASAN) and affects various system components, including readahead and I/O submission functions. The fix involves moving the BIO_THROTTLED flag set into the queue_lock to ensure proper synchronization.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.