Bug 2298118 (CVE-2022-48782) - CVE-2022-48782 kernel: mctp: fix use after free
Summary: CVE-2022-48782 kernel: mctp: fix use after free
Keywords:
Status: NEW
Alias: CVE-2022-48782
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Product Security DevOps Team
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2024-07-16 12:23 UTC by OSIDB Bzimport
Modified: 2024-08-05 21:14 UTC (History)
4 users (show)

Fixed In Version: kernel 5.16.11, kernel 5.17
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed:
Embargoed:


Attachments (Terms of Use)

Description OSIDB Bzimport 2024-07-16 12:23:57 UTC
In the Linux kernel, the following vulnerability has been resolved:

mctp: fix use after free

Clang static analysis reports this problem
route.c:425:4: warning: Use of memory after it is freed
  trace_mctp_key_acquire(key);
  ^~~~~~~~~~~~~~~~~~~~~~~~~~~
When mctp_key_add() fails, key is freed but then is later
used in trace_mctp_key_acquire().  Add an else statement
to use the key only when mctp_key_add() is successful.


Note You need to log in before you can comment on or make changes to this bug.