CVE-2022-49344

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2022-49344
In the Linux kernel, the following vulnerability has been resolved: af_unix: Fix a data-race in unix_dgram_peer_wake_me(). unix_dgram_poll() calls unix_dgram_peer_wake_me() without `other`'s lock held and check if its receive queue is full. Here we need to use unix_recvq_full_lockless() instead of unix_recvq_full(), otherwise KCSAN will report a data-race.

4.7 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.0 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity HIGH

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/556720013c36c193d9cbfb06e7b33e51f0c39fbf Patch
https://git.kernel.org/stable/c/662a80946ce13633ae90a55379f1346c10f0c432 Patch
https://git.kernel.org/stable/c/71e8bfc7f838cabc60cba24e09ca84c4f8321ab2 Patch
https://git.kernel.org/stable/c/8801eb3ccd2e4e3b1a01449383e3321ae6dbd9d6 Patch
https://git.kernel.org/stable/c/95f0ba806277733bf6024e23e27e1be773701cca Patch
https://git.kernel.org/stable/c/c61848500a3fd6867dfa4834b8c7f97133eceb9f Patch
https://git.kernel.org/stable/c/c926ae58f24f7bd55aa2ea4add9f952032507913 Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.19:rc1:*:*:*:*:*:*
History

13 Mar 2025, 22:07

Type Values Removed Values Added
CWE CWE-362
CPE cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.19:rc1:*:*:*:*:*:*
First Time Linux linux Kernel
Linux
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 4.7
References () https://git.kernel.org/stable/c/556720013c36c193d9cbfb06e7b33e51f0c39fbf - () https://git.kernel.org/stable/c/556720013c36c193d9cbfb06e7b33e51f0c39fbf - Patch
References () https://git.kernel.org/stable/c/662a80946ce13633ae90a55379f1346c10f0c432 - () https://git.kernel.org/stable/c/662a80946ce13633ae90a55379f1346c10f0c432 - Patch
References () https://git.kernel.org/stable/c/71e8bfc7f838cabc60cba24e09ca84c4f8321ab2 - () https://git.kernel.org/stable/c/71e8bfc7f838cabc60cba24e09ca84c4f8321ab2 - Patch
References () https://git.kernel.org/stable/c/8801eb3ccd2e4e3b1a01449383e3321ae6dbd9d6 - () https://git.kernel.org/stable/c/8801eb3ccd2e4e3b1a01449383e3321ae6dbd9d6 - Patch
References () https://git.kernel.org/stable/c/95f0ba806277733bf6024e23e27e1be773701cca - () https://git.kernel.org/stable/c/95f0ba806277733bf6024e23e27e1be773701cca - Patch
References () https://git.kernel.org/stable/c/c61848500a3fd6867dfa4834b8c7f97133eceb9f - () https://git.kernel.org/stable/c/c61848500a3fd6867dfa4834b8c7f97133eceb9f - Patch
References () https://git.kernel.org/stable/c/c926ae58f24f7bd55aa2ea4add9f952032507913 - () https://git.kernel.org/stable/c/c926ae58f24f7bd55aa2ea4add9f952032507913 - Patch
Summary
  • (es) En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: af_unix: Se solucionó una ejecución de datos en unix_dgram_peer_wake_me(). unix_dgram_poll() llama a unix_dgram_peer_wake_me() sin el bloqueo de `other` y verifica si su cola de recepción está llena. Aquí necesitamos usar unix_recvq_full_lockless() en lugar de unix_recvq_full(), de lo contrario KCSAN informará una ejecución de datos.

26 Feb 2025, 07:01

Type Values Removed Values Added
New CVE
Information

Published : 2025-02-26 07:01

Updated : 2025-03-13 22:07

NVD link : CVE-2022-49344

Mitre link : CVE-2022-49344

CVE.ORG link : CVE-2022-49344

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
CWE-362

Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')