CVE-2022-49388
Published: 26 February 2025
Description
In the Linux kernel, the following vulnerability has been resolved: ubi: ubi_create_volume: Fix use-after-free when volume creation failed There is an use-after-free problem for 'eba_tbl' in ubi_create_volume()'s error handling path: ubi_eba_replace_table(vol, eba_tbl) vol->eba_tbl = tbl out_mapping: ubi_eba_destroy_table(eba_tbl) // Free 'eba_tbl' out_unlock: put_device(&vol->dev) vol_release kfree(tbl->entries) // UAF Fix it by removing redundant 'eba_tbl' releasing. Fetch a reproducer in [Link].
Security Summary
CVE-2022-49388 is a use-after-free vulnerability in the Linux kernel's UBI (Unsorted Block Images) subsystem, specifically within the ubi_create_volume() function during error handling paths when volume creation fails. The issue occurs with the 'eba_tbl' structure: it is updated in vol->eba_tbl during ubi_eba_replace_table(), then freed in ubi_eba_destroy_table(), but subsequently accessed again in vol_release() via kfree(tbl->entries), leading to a use-after-free condition classified under CWE-416. This affects Linux kernel versions prior to the application of the relevant stable patches.
A local attacker with low privileges (PR:L) can exploit this vulnerability with low attack complexity (AC:L) and no user interaction required (UI:N), as indicated by the CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Successful exploitation could allow the attacker to achieve high impacts on confidentiality, integrity, and availability, potentially enabling arbitrary code execution, data corruption, or system crashes through manipulation of the freed memory in the UBI volume creation process.
Mitigation is provided through upstream Linux kernel stable patches, available in the following commits: 1174ab8ba36a48025b68b5ff1085000b1e510217, 25ff1e3a1351c0d936dd1ac2f9e58231ea1510c9, 5ff2514e4fb55dcf3d88294686040ca73ea0c1a2, 6d8d3f68cbecfd31925796f0fb668eb21ab06734, and 8302620aeb940f386817321d272b12411ae7d39f. These patches fix the issue by removing the redundant release of 'eba_tbl' to prevent the use-after-free during error paths. Security practitioners should ensure systems using UBI are updated to kernels incorporating these fixes.
Details
- CWE(s)