Use-After-Free Vulnerability in Linux Kernel Related to fsl_mc_bus Device Management

CVE-2022-49711

What is CVE-2022-49711?

A use-after-free vulnerability has been identified in the Linux kernel, specifically within the fsl-mc-bus device management code. The issue arises in the fsl_mc_bus_remove() function, where a reference to a freed device is used, potentially leading to memory corruption. This can occur since mc->root_mc_bus_dev is deallocated in fsl_mc_device_remove(), resulting in accessing mc->root_mc_bus_dev->mc_io after it has been released. The vulnerability is addressed by storing a reference to mc->root_mc_bus_dev->mc_io in a temporary variable before it is passed to fsl_destroy_mc_io(), thus preventing access to invalid memory locations. The current patch needs to be adapted for use in kernel versions older than 5.15.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References