CVE-2022-49647

Summary

CVE-2022-49647 is a vulnerability affecting the Linux kernel that stems from an issue with cgroup preloading nodes. Specifically, using the same node for both source and destination csets during migration led to unexpected behavior. When multiple tasks are involved in a migration, identity noop migrations and actual migrations can occur concurrently, resulting in one cset being excluded from the destination list while it's still in use for the source list. This issue can lead to a use-after-free scenario, where the cset is destroyed before the migration has finished, causing potential memory corruption. The patch resolves this vulnerability by separating cset->mg_preload_node into ->mg_src_preload_node and ->mg_dst_preload_node to ensure proper handling of source and destination csets during migration.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.