#VU104736 Double free in Linux kernel - CVE-2022-49455

Vulnerability identifier: #VU104736

Vulnerability risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2022-49455

CWE-ID: CWE-415

Exploitation vector: Local

Exploit availability: No

Vulnerable software:
Linux kernel
Operating systems & Components / Operating system

Vendor: Linux Foundation

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to a double free error within the ocxl_file_register_afu() function in drivers/misc/ocxl/file.c. A local user can perform a denial of service (DoS) attack.

Mitigation
Install update from vendor's website.

Vulnerable software versions

Linux kernel: All versions

---

External links
https://git.kernel.org/stable/c/252768d32e92c1214aeebb5fec0844ca479bcf5c
https://git.kernel.org/stable/c/8fb674216835e1f0c143762696d645facebb4685
https://git.kernel.org/stable/c/950cf957fe34d40d63dfa3bf3968210430b6491e
https://git.kernel.org/stable/c/9e9087cf34ee69f4e95d146ac29385d6e367a97b
https://git.kernel.org/stable/c/de65c32ace9aa70d51facc61ba986607075e3a25
https://git.kernel.org/stable/c/ee89d8dee55ab4b3b8ad8b70866b2841ba334767

---

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.