CVE-2022-49696

Summary

CVE-2022-49696 is a use-after-free vulnerability identified in the Linux kernel's tipc subsystem. Specifically, in the function tipc_named_reinit, a read operation is performed on a potentially freed memory address. This issue was discovered during a Google Compute Engine instance running Linux kernel 5.18.0-rc4-syzkaller. The vulnerability arose due to an unguarded call to tipc_named_reinit during the destruction of a tipc namespace, allowing a task to access memory that had already been freed. To address this, a change was made to ensure that the worktipc_net_finalize_work() was completed before canceling the tipc namespace, thereby preventing the use-after-free vulnerability.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.