#VU104737 Double free in Linux kernel - CVE-2022-49508

Vulnerability identifier: #VU104737

Vulnerability risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2022-49508

CWE-ID: CWE-415

Exploitation vector: Local

Exploit availability: No

Vulnerable software:
Linux kernel
Operating systems & Components / Operating system

Vendor: Linux Foundation

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to a double free error within the elan_input_configured() function in drivers/hid/hid-elan.c. A local user can perform a denial of service (DoS) attack.

Mitigation
Install update from vendor's website.

Vulnerable software versions

Linux kernel: All versions

---

External links
https://git.kernel.org/stable/c/1af20714fedad238362571620be0bd690ded05b6
https://git.kernel.org/stable/c/24f9dfdaece9bd75bb8dbfdba83eddeefdf7dc47
https://git.kernel.org/stable/c/5291451851feeb66fd4bf0826710f482f3b1ab38
https://git.kernel.org/stable/c/6d0726725c7c560495f5ff364862a2cefea542e3
https://git.kernel.org/stable/c/8bb1716507ebf12d50bbf181764481de3b6bc7fd
https://git.kernel.org/stable/c/c92ec22a991778a096342cf1a917ae36c5c86a90
https://git.kernel.org/stable/c/f1d4f19a796551edc6679a681ea1756b8c578c08

---

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.