CVE-2022-49711

Summary

CVE-2022-49711 is a use-after-free vulnerability affecting the Linux kernel's fsl-mc-bus driver. In the function fsl_mc_bus_remove(), a reference to mc->root_mc_bus_dev->mc_io is passed to fsl_destroy_mc_io(), but mc->root_mc_bus_dev has already been freed in fsl_mc_device_remove(). This results in a use-after-free condition, triggering the KASAN (Kernel Address Sanitizer) tool. To mitigate this issue, the reference to mc->root_mc_bus_dev->mc_io should be kept in a local variable and passed to fsl_destroy_mc_io() instead. However, this patch requires modification to apply to kernel versions prior to v5.15.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.