Use After Free Vulnerability in lio_listio System Call

CVE-2022-23090

What is CVE-2022-23090?

The aio_aqueue function, associated with the lio_listio system call in FreeBSD, has a significant flaw wherein it fails to release a reference to credentials during error conditions. This oversight can allow an attacker to manipulate the reference count, potentially leading to a use-after-free condition. Such vulnerabilities can have profound implications, potentially enabling unauthorized access, data manipulation or system instability. It's essential for users of the affected FreeBSD versions to review security advisories and implement the recommended mitigations promptly.

References