CVEvulnerability

CVE-2022-4696

7.8 HIGH Published 2023-01-11 Modified 2026-09-01 Official page ↗
Status
Analyzed
Published
2023-01-11
Last modified
2026-09-01
Assigner
[email protected]
CVSS 3.1 ([email protected])
7.8 HIGH — CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS 3.1 ([email protected])
7.8 HIGH — CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-416, CWE-763

Description

There exists a use-after-free vulnerability in the Linux kernel through io_uring and the IORING_OP_SPLICE operation. If IORING_OP_SPLICE is missing the IO_WQ_WORK_FILES flag, which signals that the operation won't use current->nsproxy, so its reference counter is not increased. This assumption is not always true as calling io_splice on specific files will call the get_uts function which will use current->nsproxy leading to invalidly decreasing its reference counter later causing the use-after-free vulnerability. We recommend upgrading to version 5.10.160 or above

Affected configurations

• netapp h410s firmware • netapp h410c firmware • netapp h700s firmware • netapp h500s firmware • netapp h300s firmware • linux linux kernel (>= 5.4 < 5.10.160) • linux linux kernel (>= 5.11 < 5.12)

Related

Weakness · CWE (2)

  • CWE-416 Use After Free weakness
  • CWE-763 Release of Invalid Pointer or Reference weakness

References