Double free in Linux kernel misc ocxl driver

1) Double free

EUVDB-ID: #VU104736

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2022-49455

CWE-ID: CWE-415 - Double Free

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to a double free error within the ocxl_file_register_afu() function in drivers/misc/ocxl/file.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Linux kernel: All versions

CPE2.3

• cpe:2.3:o:linux_foundation:linux_kernel:*:*:*:*:*:*:*:*

External links

https://git.kernel.org/stable/c/252768d32e92c1214aeebb5fec0844ca479bcf5c
https://git.kernel.org/stable/c/8fb674216835e1f0c143762696d645facebb4685
https://git.kernel.org/stable/c/950cf957fe34d40d63dfa3bf3968210430b6491e
https://git.kernel.org/stable/c/9e9087cf34ee69f4e95d146ac29385d6e367a97b
https://git.kernel.org/stable/c/de65c32ace9aa70d51facc61ba986607075e3a25
https://git.kernel.org/stable/c/ee89d8dee55ab4b3b8ad8b70866b2841ba334767

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.