CVE-2022-48988 (GCVE-0-2022-48988)

Vulnerability from cvelistv5 – Published: 2024-10-21 20:06 – Updated: 2025-05-04 08:27
VLAI?
Title
memcg: fix possible use-after-free in memcg_write_event_control()
Summary
In the Linux kernel, the following vulnerability has been resolved: memcg: fix possible use-after-free in memcg_write_event_control() memcg_write_event_control() accesses the dentry->d_name of the specified control fd to route the write call. As a cgroup interface file can't be renamed, it's safe to access d_name as long as the specified file is a regular cgroup file. Also, as these cgroup interface files can't be removed before the directory, it's safe to access the parent too. Prior to 347c4a874710 ("memcg: remove cgroup_event->cft"), there was a call to __file_cft() which verified that the specified file is a regular cgroupfs file before further accesses. The cftype pointer returned from __file_cft() was no longer necessary and the commit inadvertently dropped the file type check with it allowing any file to slip through. With the invarients broken, the d_name and parent accesses can now race against renames and removals of arbitrary files and cause use-after-free's. Fix the bug by resurrecting the file type check in __file_cft(). Now that cgroupfs is implemented through kernfs, checking the file operations needs to go through a layer of indirection. Instead, let's check the superblock and dentry type.
Severity ?
No CVSS data available.
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 347c4a8747104a945ecced358944e42879176ca5 , < b77600e26fd48727a95ffd50ba1e937efb548125 (git)
Affected: 347c4a8747104a945ecced358944e42879176ca5 , < e1ae97624ecf400ea56c238bff23e5cd139df0b8 (git)
Affected: 347c4a8747104a945ecced358944e42879176ca5 , < 35963b31821920908e397146502066f6b032c917 (git)
Affected: 347c4a8747104a945ecced358944e42879176ca5 , < f1f7f36cf682fa59db15e2089039a2eeb58ff2ad (git)
Affected: 347c4a8747104a945ecced358944e42879176ca5 , < aad8bbd17a1d586005feb9226c2e9cfce1432e13 (git)
Affected: 347c4a8747104a945ecced358944e42879176ca5 , < 0ed074317b835caa6c03bcfa8f133365324673dc (git)
Affected: 347c4a8747104a945ecced358944e42879176ca5 , < 4a7ba45b1a435e7097ca0f79a847d0949d0eb088 (git)
Create a notification for this product.
    Linux Linux Affected: 3.14
Unaffected: 0 , < 3.14 (semver)
Unaffected: 4.14.302 , ≤ 4.14.* (semver)
Unaffected: 4.19.269 , ≤ 4.19.* (semver)
Unaffected: 5.4.227 , ≤ 5.4.* (semver)
Unaffected: 5.10.159 , ≤ 5.10.* (semver)
Unaffected: 5.15.83 , ≤ 5.15.* (semver)
Unaffected: 6.0.13 , ≤ 6.0.* (semver)
Unaffected: 6.1 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2022-48988",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-10-22T13:16:57.577077Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-10-22T13:18:42.631Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "include/linux/cgroup.h",
            "kernel/cgroup/cgroup-internal.h",
            "mm/memcontrol.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "b77600e26fd48727a95ffd50ba1e937efb548125",
              "status": "affected",
              "version": "347c4a8747104a945ecced358944e42879176ca5",
              "versionType": "git"
            },
            {
              "lessThan": "e1ae97624ecf400ea56c238bff23e5cd139df0b8",
              "status": "affected",
              "version": "347c4a8747104a945ecced358944e42879176ca5",
              "versionType": "git"
            },
            {
              "lessThan": "35963b31821920908e397146502066f6b032c917",
              "status": "affected",
              "version": "347c4a8747104a945ecced358944e42879176ca5",
              "versionType": "git"
            },
            {
              "lessThan": "f1f7f36cf682fa59db15e2089039a2eeb58ff2ad",
              "status": "affected",
              "version": "347c4a8747104a945ecced358944e42879176ca5",
              "versionType": "git"
            },
            {
              "lessThan": "aad8bbd17a1d586005feb9226c2e9cfce1432e13",
              "status": "affected",
              "version": "347c4a8747104a945ecced358944e42879176ca5",
              "versionType": "git"
            },
            {
              "lessThan": "0ed074317b835caa6c03bcfa8f133365324673dc",
              "status": "affected",
              "version": "347c4a8747104a945ecced358944e42879176ca5",
              "versionType": "git"
            },
            {
              "lessThan": "4a7ba45b1a435e7097ca0f79a847d0949d0eb088",
              "status": "affected",
              "version": "347c4a8747104a945ecced358944e42879176ca5",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "include/linux/cgroup.h",
            "kernel/cgroup/cgroup-internal.h",
            "mm/memcontrol.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.14"
            },
            {
              "lessThan": "3.14",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.14.*",
              "status": "unaffected",
              "version": "4.14.302",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.19.*",
              "status": "unaffected",
              "version": "4.19.269",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.227",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.159",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.83",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.0.*",
              "status": "unaffected",
              "version": "6.0.13",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.14.302",
                  "versionStartIncluding": "3.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.19.269",
                  "versionStartIncluding": "3.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.227",
                  "versionStartIncluding": "3.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.159",
                  "versionStartIncluding": "3.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.83",
                  "versionStartIncluding": "3.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.0.13",
                  "versionStartIncluding": "3.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1",
                  "versionStartIncluding": "3.14",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmemcg: fix possible use-after-free in memcg_write_event_control()\n\nmemcg_write_event_control() accesses the dentry-\u003ed_name of the specified\ncontrol fd to route the write call.  As a cgroup interface file can\u0027t be\nrenamed, it\u0027s safe to access d_name as long as the specified file is a\nregular cgroup file.  Also, as these cgroup interface files can\u0027t be\nremoved before the directory, it\u0027s safe to access the parent too.\n\nPrior to 347c4a874710 (\"memcg: remove cgroup_event-\u003ecft\"), there was a\ncall to __file_cft() which verified that the specified file is a regular\ncgroupfs file before further accesses.  The cftype pointer returned from\n__file_cft() was no longer necessary and the commit inadvertently dropped\nthe file type check with it allowing any file to slip through.  With the\ninvarients broken, the d_name and parent accesses can now race against\nrenames and removals of arbitrary files and cause use-after-free\u0027s.\n\nFix the bug by resurrecting the file type check in __file_cft().  Now that\ncgroupfs is implemented through kernfs, checking the file operations needs\nto go through a layer of indirection.  Instead, let\u0027s check the superblock\nand dentry type."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-05-04T08:27:35.599Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/b77600e26fd48727a95ffd50ba1e937efb548125"
        },
        {
          "url": "https://git.kernel.org/stable/c/e1ae97624ecf400ea56c238bff23e5cd139df0b8"
        },
        {
          "url": "https://git.kernel.org/stable/c/35963b31821920908e397146502066f6b032c917"
        },
        {
          "url": "https://git.kernel.org/stable/c/f1f7f36cf682fa59db15e2089039a2eeb58ff2ad"
        },
        {
          "url": "https://git.kernel.org/stable/c/aad8bbd17a1d586005feb9226c2e9cfce1432e13"
        },
        {
          "url": "https://git.kernel.org/stable/c/0ed074317b835caa6c03bcfa8f133365324673dc"
        },
        {
          "url": "https://git.kernel.org/stable/c/4a7ba45b1a435e7097ca0f79a847d0949d0eb088"
        }
      ],
      "title": "memcg: fix possible use-after-free in memcg_write_event_control()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2022-48988",
    "datePublished": "2024-10-21T20:06:04.601Z",
    "dateReserved": "2024-08-22T01:27:53.634Z",
    "dateUpdated": "2025-05-04T08:27:35.599Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2022-48988\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-10-22T13:16:57.577077Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-10-22T13:17:00.743Z\"}}], \"cna\": {\"title\": \"memcg: fix possible use-after-free in memcg_write_event_control()\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"347c4a8747104a945ecced358944e42879176ca5\", \"lessThan\": \"b77600e26fd48727a95ffd50ba1e937efb548125\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"347c4a8747104a945ecced358944e42879176ca5\", \"lessThan\": \"e1ae97624ecf400ea56c238bff23e5cd139df0b8\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"347c4a8747104a945ecced358944e42879176ca5\", \"lessThan\": \"35963b31821920908e397146502066f6b032c917\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"347c4a8747104a945ecced358944e42879176ca5\", \"lessThan\": \"f1f7f36cf682fa59db15e2089039a2eeb58ff2ad\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"347c4a8747104a945ecced358944e42879176ca5\", \"lessThan\": \"aad8bbd17a1d586005feb9226c2e9cfce1432e13\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"347c4a8747104a945ecced358944e42879176ca5\", \"lessThan\": \"0ed074317b835caa6c03bcfa8f133365324673dc\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"347c4a8747104a945ecced358944e42879176ca5\", \"lessThan\": \"4a7ba45b1a435e7097ca0f79a847d0949d0eb088\", \"versionType\": \"git\"}], \"programFiles\": [\"include/linux/cgroup.h\", \"kernel/cgroup/cgroup-internal.h\", \"mm/memcontrol.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"3.14\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"3.14\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"4.14.302\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"4.14.*\"}, {\"status\": \"unaffected\", \"version\": \"4.19.269\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"4.19.*\"}, {\"status\": \"unaffected\", \"version\": \"5.4.227\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.4.*\"}, {\"status\": \"unaffected\", \"version\": \"5.10.159\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.10.*\"}, {\"status\": \"unaffected\", \"version\": \"5.15.83\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.15.*\"}, {\"status\": \"unaffected\", \"version\": \"6.0.13\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.0.*\"}, {\"status\": \"unaffected\", \"version\": \"6.1\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"include/linux/cgroup.h\", \"kernel/cgroup/cgroup-internal.h\", \"mm/memcontrol.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/b77600e26fd48727a95ffd50ba1e937efb548125\"}, {\"url\": \"https://git.kernel.org/stable/c/e1ae97624ecf400ea56c238bff23e5cd139df0b8\"}, {\"url\": \"https://git.kernel.org/stable/c/35963b31821920908e397146502066f6b032c917\"}, {\"url\": \"https://git.kernel.org/stable/c/f1f7f36cf682fa59db15e2089039a2eeb58ff2ad\"}, {\"url\": \"https://git.kernel.org/stable/c/aad8bbd17a1d586005feb9226c2e9cfce1432e13\"}, {\"url\": \"https://git.kernel.org/stable/c/0ed074317b835caa6c03bcfa8f133365324673dc\"}, {\"url\": \"https://git.kernel.org/stable/c/4a7ba45b1a435e7097ca0f79a847d0949d0eb088\"}], \"x_generator\": {\"engine\": \"bippy-5f407fcff5a0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nmemcg: fix possible use-after-free in memcg_write_event_control()\\n\\nmemcg_write_event_control() accesses the dentry-\u003ed_name of the specified\\ncontrol fd to route the write call.  As a cgroup interface file can\u0027t be\\nrenamed, it\u0027s safe to access d_name as long as the specified file is a\\nregular cgroup file.  Also, as these cgroup interface files can\u0027t be\\nremoved before the directory, it\u0027s safe to access the parent too.\\n\\nPrior to 347c4a874710 (\\\"memcg: remove cgroup_event-\u003ecft\\\"), there was a\\ncall to __file_cft() which verified that the specified file is a regular\\ncgroupfs file before further accesses.  The cftype pointer returned from\\n__file_cft() was no longer necessary and the commit inadvertently dropped\\nthe file type check with it allowing any file to slip through.  With the\\ninvarients broken, the d_name and parent accesses can now race against\\nrenames and removals of arbitrary files and cause use-after-free\u0027s.\\n\\nFix the bug by resurrecting the file type check in __file_cft().  Now that\\ncgroupfs is implemented through kernfs, checking the file operations needs\\nto go through a layer of indirection.  Instead, let\u0027s check the superblock\\nand dentry type.\"}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2024-12-19T08:11:59.021Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2022-48988\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2024-12-19T08:11:59.021Z\", \"dateReserved\": \"2024-08-22T01:27:53.634Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-10-21T20:06:04.601Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.