CVE-2022-49410
Published: 26 February 2025
Description
In the Linux kernel, the following vulnerability has been resolved: tracing: Fix potential double free in create_var_ref() In create_var_ref(), init_var_ref() is called to initialize the fields of variable ref_field, which is allocated in the previous function call to create_hist_field(). Function init_var_ref() allocates the corresponding fields such as ref_field->system, but frees these fields when the function encounters an error. The caller later calls destroy_hist_field() to conduct error handling, which frees the fields and the variable itself. This results in double free of the fields which are already freed in the previous function. Fix this by storing NULL to the corresponding fields when they are freed in init_var_ref().
Security Summary
CVE-2022-49410 is a double free vulnerability (CWE-415) in the Linux kernel's tracing subsystem, specifically within the create_var_ref() function. The issue arises when init_var_ref() initializes fields of a variable reference allocated by create_hist_field(), but frees those fields (such as ref_field->system) on error. Subsequent error handling in the caller via destroy_hist_field() then frees the same fields and the variable itself, resulting in a double free. The vulnerability carries a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
A local attacker with low privileges can exploit this vulnerability due to its low attack complexity and lack of user interaction requirements. Successful exploitation could lead to high impacts on confidentiality, integrity, and availability, potentially allowing arbitrary code execution, data corruption, or system crashes through the double free in kernel memory management.
Mitigation involves applying the upstream kernel patches referenced in the stable repository commits, such as 058cb6d86b9789377216c936506b346aaa1eb581, 37443b3508b8cce6832f8d25cb4550b2f7801f50, 4fdfb15e08598711dbf50daf56a33965232daf0e, 99696a2592bca641eb88cc9a80c90e591afebd0f, and bd83ff3bbfb003832481c9bff999d12385f396ae. These patches resolve the issue by storing NULL in the corresponding fields when they are freed within init_var_ref(), preventing the double free during subsequent cleanup.
Details
- CWE(s)