Use After Free Vulnerability in Linux Kernel Affecting IPv6 Network Configurations

CVE-2022-50310

What is CVE-2022-50310?

A vulnerability exists in the Linux kernel's IPv6 networking component that may lead to a use-after-free condition. When the initialization function addrconf_init_net() fails, it can leave the devconf_all pointer in a freed state. The function ip6mr_sk_done() subsequently accesses this invalid pointer during cleanup operations, potentially leading to unauthorized memory access and unpredictable behavior. This flaw may compromise security and system integrity if exploited, underscoring the importance of timely updates and patches to safeguard affected systems.

References