CVE-2022-48873

In the Linux kernel, the following vulnerability has been resolved:

misc: fastrpc: Dont remove map on creater_process and device_release

Do not remove the map from the list on error path in fastrpc_init_create_process, instead call fastrpc_map_put, to avoid use-after-free. Do not remove it on fastrpc_device_release either, call fastrpc_map_put instead.

The fastrpc_free_map is the only proper place to remove the map. This is called only after the reference count is 0.

Weakness

The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory “belongs” to the code that operates on the new pointer.

Affected Software

Potential Mitigations

References

• https://git.kernel.org/stable/c/193cd853145b63e670bd73740250983af1475330
• https://git.kernel.org/stable/c/1b7b7bb400dd13dcb03fc6e591bb7ca4664bbec8
• https://git.kernel.org/stable/c/35ddd482345c43d9eec1f3406c0f20a95ed4054b
• https://git.kernel.org/stable/c/4b5c44e924a571d0ad07054de549624fbc04e4d7
• https://git.kernel.org/stable/c/5bb96c8f9268e2fdb0e5321cbc358ee5941efc15