CVE-2022-48872

misc: fastrpc: Fix use-after-free race condition for maps

State: Published
Severity: 7.8 High
Published: Aug 21, 2024
Updated: Aug 5, 2026
Reserved: Jul 16, 2024

Description

In the Linux kernel, the following vulnerability has been resolved:

misc: fastrpc: Fix use-after-free race condition for maps

It is possible that in between calling fastrpc_map_get() until map->fl->lock is taken in fastrpc_free_map(), another thread can call fastrpc_map_lookup() and get a reference to a map that is about to be deleted.

Rewrite fastrpc_map_get() to only increase the reference count of a map if it's non-zero. Propagate this to callers so they can know if a map is about to be deleted.

Fixes this warning: refcount_t: addition on 0; use-after-free. WARNING: CPU: 5 PID: 10100 at lib/refcount.c:25 refcount_warn_saturate ... Call trace: refcount_warn_saturate [fastrpc_map_get inlined] [fastrpc_map_lookup inlined] fastrpc_map_create fastrpc_internal_invoke fastrpc_device_ioctl __arm64_sys_ioctl invoke_syscall

Scores

CVSS	Score	Vector	Source
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	c68cfb718c8f97b7f7a50ed66be5feb42d0c8988 to before 556dfdb226ce1e5231d8836159b23f8bb0395bf4Affected c68cfb718c8f97b7f7a50ed66be5feb42d0c8988 to before b171d0d2cf1b8387c72c8d325c5d5746fa271e39Affected c68cfb718c8f97b7f7a50ed66be5feb42d0c8988 to before 61a0890cb95afec5c8a2f4a879de2b6220984ef1Affected c68cfb718c8f97b7f7a50ed66be5feb42d0c8988 to before 079c78c68714f7d8d58e66c477b0243b31806907Affected c68cfb718c8f97b7f7a50ed66be5feb42d0c8988 to before 96b328d119eca7563c1edcc4e1039a62e6370ecbAffected
LinuxLinux	5.1Affected before 5.1Not affected 5.4.230 through 5.4.Not affected 5.10.165 through 5.10.Not affected 5.15.90 through 5.15.Not affected 6.1.8 through 6.1.Not affected 6.2 and laterNot affected

Product

Versions

LinuxLinux

c68cfb718c8f97b7f7a50ed66be5feb42d0c8988 to before 556dfdb226ce1e5231d8836159b23f8bb0395bf4Affected
c68cfb718c8f97b7f7a50ed66be5feb42d0c8988 to before b171d0d2cf1b8387c72c8d325c5d5746fa271e39Affected
c68cfb718c8f97b7f7a50ed66be5feb42d0c8988 to before 61a0890cb95afec5c8a2f4a879de2b6220984ef1Affected
c68cfb718c8f97b7f7a50ed66be5feb42d0c8988 to before 079c78c68714f7d8d58e66c477b0243b31806907Affected
c68cfb718c8f97b7f7a50ed66be5feb42d0c8988 to before 96b328d119eca7563c1edcc4e1039a62e6370ecbAffected

LinuxLinux

5.1Affected
before 5.1Not affected
5.4.230 through 5.4.*Not affected
5.10.165 through 5.10.*Not affected
5.15.90 through 5.15.*Not affected
6.1.8 through 6.1.*Not affected
6.2 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.