CVE-2022-49685

Summary

CVE-2022-49685 is a use-after-free vulnerability affecting the Linux kernel's iio subsystem. Specifically, in the 'irq_work_run_list', KASAN detected a use-after-free issue where the irq_work structure was freed before it had completed its tasks. This vulnerability can lead to a read of arbitrary memory, as demonstrated in the call trace. The issue was caused by a race condition in the iio_sysfs_trig_add and iio_sysfs_trig_remove functions, which were responsible for adding and removing triggers in the sysfs filesystem. The vulnerability was allocated and freed by task 25, and could potentially be exploited to execute arbitrary code.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.