CVE-2022-49626

Summary

CVE-2022-49626 is a use-after-free vulnerability discovered in the Linux kernel's sfc subsystem. This issue occurs when disabling Single Root I/O Virtualization (SR-IOV) and results in a pointer being freed in one function and later being read in another, leading to a use-after-free read. The affected functions include "efx_ef10_sriov_free_vf_vswitching," "efx_pci_sriov_configure," and "sriov_numvfs_store." The vulnerability was initially detected in the kernel's kfence function, which is designed to protect against use-after-free conditions. The issue can be reproduced by enabling and disabling SR-IOV for a network device, and the affected code was allocated and freed by the same task on different CPUs.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.