Vulnerability Details CVE-2022-48670
In the Linux kernel, the following vulnerability has been resolved:
peci: cpu: Fix use-after-free in adev_release()
When auxiliary_device_add() returns an error, auxiliary_device_uninit()
is called, which causes refcount for device to be decremented and
.release callback will be triggered.
Because adev_release() re-calls auxiliary_device_uninit(), it will cause
use-after-free:
[ 1269.455172] WARNING: CPU: 0 PID: 14267 at lib/refcount.c:28 refcount_warn_saturate+0x110/0x15
[ 1269.464007] refcount_t: underflow; use-after-free.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.002
EPSS Ranking 11.3%
CVSS Severity
CVSS v3 Score 7.8
References
Products affected by CVE-2022-48670
-
cpe:2.3:o:linux:linux_kernel:5.18
-
cpe:2.3:o:linux:linux_kernel:5.18.1
-
cpe:2.3:o:linux:linux_kernel:5.18.10
-
cpe:2.3:o:linux:linux_kernel:5.18.11
-
cpe:2.3:o:linux:linux_kernel:5.18.12
-
cpe:2.3:o:linux:linux_kernel:5.18.13
-
cpe:2.3:o:linux:linux_kernel:5.18.14
-
cpe:2.3:o:linux:linux_kernel:5.18.15
-
cpe:2.3:o:linux:linux_kernel:5.18.16
-
cpe:2.3:o:linux:linux_kernel:5.18.17
-
cpe:2.3:o:linux:linux_kernel:5.18.18
-
cpe:2.3:o:linux:linux_kernel:5.18.19
-
cpe:2.3:o:linux:linux_kernel:5.18.2
-
cpe:2.3:o:linux:linux_kernel:5.18.3
-
cpe:2.3:o:linux:linux_kernel:5.18.4
-
cpe:2.3:o:linux:linux_kernel:5.18.5
-
cpe:2.3:o:linux:linux_kernel:5.18.6
-
cpe:2.3:o:linux:linux_kernel:5.18.7
-
cpe:2.3:o:linux:linux_kernel:5.18.8
-
cpe:2.3:o:linux:linux_kernel:5.18.9
-
cpe:2.3:o:linux:linux_kernel:5.19
-
cpe:2.3:o:linux:linux_kernel:5.19.1
-
cpe:2.3:o:linux:linux_kernel:5.19.2
-
cpe:2.3:o:linux:linux_kernel:5.19.3
-
cpe:2.3:o:linux:linux_kernel:5.19.4
-
cpe:2.3:o:linux:linux_kernel:5.19.5
-
cpe:2.3:o:linux:linux_kernel:5.19.6
-
cpe:2.3:o:linux:linux_kernel:5.19.7
-
cpe:2.3:o:linux:linux_kernel:5.19.8
-
cpe:2.3:o:linux:linux_kernel:5.19.9
-
cpe:2.3:o:linux:linux_kernel:6.0