Use-after-free in Linux kernel ext4

1) Use-after-free

EUVDB-ID: #VU104435

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2022-49349

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the ext4_get_first_dir_block() function in fs/ext4/namei.c. A local user can escalate privileges on the system.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Linux kernel: All versions

CPE2.3

• cpe:2.3:o:linux_foundation:linux_kernel:*:*:*:*:*:*:*:*

External links

https://git.kernel.org/stable/c/0be698ecbe4471fcad80e81ec6a05001421041b3
https://git.kernel.org/stable/c/0ff38b99fa075ddd246487a28cb9af049f4ceef1
https://git.kernel.org/stable/c/10801095224de0d0ab06ae60698680c1f883a3ae
https://git.kernel.org/stable/c/1a3a15bf6f9963d755270cbdb282863b84839195
https://git.kernel.org/stable/c/364380c00912bed9b5d99eb485018360b0ecf64f
https://git.kernel.org/stable/c/4a2bea60cf7ff957b3eda0b17750d483876a02fa
https://git.kernel.org/stable/c/97f802a652a749422dede32071d29a53cf4bd034
https://git.kernel.org/stable/c/dd887f83ea54aea5b780a84527e23ab95f777fed
https://git.kernel.org/stable/c/eaecf7ebfd5dd09038a80b14be46b844f54cfc5c

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.