github - ghsa-wg5x-3j3h-vr62

ghsa-wg5x-3j3h-vr62

Vulnerability from github

Published

2024-08-21 09:31

Modified

2024-09-11 18:31

Severity ?

4.7 (Medium) - CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H

Details

In the Linux kernel, the following vulnerability has been resolved:

drm/virtio: Fix GEM handle creation UAF

Userspace can guess the handle value and try to race GEM object creation with handle close, resulting in a use-after-free if we dereference the object after dropping the handle's reference. For that reason, dropping the handle's reference must be done after we are done dereferencing the object.

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2022-48899"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-416"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-08-21T07:15:05Z",
    "severity": "MODERATE"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/virtio: Fix GEM handle creation UAF\n\nUserspace can guess the handle value and try to race GEM object creation\nwith handle close, resulting in a use-after-free if we dereference the\nobject after dropping the handle\u0027s reference.  For that reason, dropping\nthe handle\u0027s reference must be done *after* we are done dereferencing\nthe object.",
  "id": "GHSA-wg5x-3j3h-vr62",
  "modified": "2024-09-11T18:31:02Z",
  "published": "2024-08-21T09:31:32Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-48899"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/011ecdbcd520c90c344b872ca6b4821f7783b2f8"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/19ec87d06acfab2313ee82b2a689bf0c154e57ea"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/52531258318ed59a2dc5a43df2eaf0eb1d65438e"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/68bcd063857075d2f9edfed6024387ac377923e2"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/adc48e5e408afbb01d261bd303fd9fbbbaa3e317"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/d01d6d2b06c0d8390adf8f3ba08aa60b5642ef73"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

cve-2022-48899

Vulnerability from cvelistv5

Published

2024-08-21 06:10

Modified

2024-12-19 08:10

Severity ?

Summary

In the Linux kernel, the following vulnerability has been resolved: drm/virtio: Fix GEM handle creation UAF Userspace can guess the handle value and try to race GEM object creation with handle close, resulting in a use-after-free if we dereference the object after dropping the handle's reference. For that reason, dropping the handle's reference must be done *after* we are done dereferencing the object.

References

▼	URL	Tags
	https://git.kernel.org/stable/c/19ec87d06acfab2313ee82b2a689bf0c154e57ea
	https://git.kernel.org/stable/c/d01d6d2b06c0d8390adf8f3ba08aa60b5642ef73
	https://git.kernel.org/stable/c/68bcd063857075d2f9edfed6024387ac377923e2
	https://git.kernel.org/stable/c/011ecdbcd520c90c344b872ca6b4821f7783b2f8
	https://git.kernel.org/stable/c/adc48e5e408afbb01d261bd303fd9fbbbaa3e317
	https://git.kernel.org/stable/c/52531258318ed59a2dc5a43df2eaf0eb1d65438e

Impacted products

Vendor

Product

Version

▼

Linux

Version: 62fb7a5e10962ac6ae2a2d2dbd3aedcb2a3e3257
Version: 62fb7a5e10962ac6ae2a2d2dbd3aedcb2a3e3257
Version: 62fb7a5e10962ac6ae2a2d2dbd3aedcb2a3e3257
Version: 62fb7a5e10962ac6ae2a2d2dbd3aedcb2a3e3257
Version: 62fb7a5e10962ac6ae2a2d2dbd3aedcb2a3e3257
Version: 62fb7a5e10962ac6ae2a2d2dbd3aedcb2a3e3257

Linux

Version: 4.4

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2022-48899",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T16:03:56.343879Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-12T17:33:15.193Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/virtio/virtgpu_ioctl.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "19ec87d06acfab2313ee82b2a689bf0c154e57ea",
              "status": "affected",
              "version": "62fb7a5e10962ac6ae2a2d2dbd3aedcb2a3e3257",
              "versionType": "git"
            },
            {
              "lessThan": "d01d6d2b06c0d8390adf8f3ba08aa60b5642ef73",
              "status": "affected",
              "version": "62fb7a5e10962ac6ae2a2d2dbd3aedcb2a3e3257",
              "versionType": "git"
            },
            {
              "lessThan": "68bcd063857075d2f9edfed6024387ac377923e2",
              "status": "affected",
              "version": "62fb7a5e10962ac6ae2a2d2dbd3aedcb2a3e3257",
              "versionType": "git"
            },
            {
              "lessThan": "011ecdbcd520c90c344b872ca6b4821f7783b2f8",
              "status": "affected",
              "version": "62fb7a5e10962ac6ae2a2d2dbd3aedcb2a3e3257",
              "versionType": "git"
            },
            {
              "lessThan": "adc48e5e408afbb01d261bd303fd9fbbbaa3e317",
              "status": "affected",
              "version": "62fb7a5e10962ac6ae2a2d2dbd3aedcb2a3e3257",
              "versionType": "git"
            },
            {
              "lessThan": "52531258318ed59a2dc5a43df2eaf0eb1d65438e",
              "status": "affected",
              "version": "62fb7a5e10962ac6ae2a2d2dbd3aedcb2a3e3257",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/virtio/virtgpu_ioctl.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.4"
            },
            {
              "lessThan": "4.4",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.19.*",
              "status": "unaffected",
              "version": "4.19.270",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.229",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.164",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.89",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.7",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/virtio: Fix GEM handle creation UAF\n\nUserspace can guess the handle value and try to race GEM object creation\nwith handle close, resulting in a use-after-free if we dereference the\nobject after dropping the handle\u0027s reference.  For that reason, dropping\nthe handle\u0027s reference must be done *after* we are done dereferencing\nthe object."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-12-19T08:10:07.743Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/19ec87d06acfab2313ee82b2a689bf0c154e57ea"
        },
        {
          "url": "https://git.kernel.org/stable/c/d01d6d2b06c0d8390adf8f3ba08aa60b5642ef73"
        },
        {
          "url": "https://git.kernel.org/stable/c/68bcd063857075d2f9edfed6024387ac377923e2"
        },
        {
          "url": "https://git.kernel.org/stable/c/011ecdbcd520c90c344b872ca6b4821f7783b2f8"
        },
        {
          "url": "https://git.kernel.org/stable/c/adc48e5e408afbb01d261bd303fd9fbbbaa3e317"
        },
        {
          "url": "https://git.kernel.org/stable/c/52531258318ed59a2dc5a43df2eaf0eb1d65438e"
        }
      ],
      "title": "drm/virtio: Fix GEM handle creation UAF",
      "x_generator": {
        "engine": "bippy-5f407fcff5a0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2022-48899",
    "datePublished": "2024-08-21T06:10:31.936Z",
    "dateReserved": "2024-08-21T06:06:23.291Z",
    "dateUpdated": "2024-12-19T08:10:07.743Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted