{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2022-48988", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-08-22T01:27:53.634Z", "datePublished": "2024-10-21T20:06:04.601Z", "dateUpdated": "2026-08-05T08:53:17.372Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T08:53:17.372Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmemcg: fix possible use-after-free in memcg_write_event_control()\n\nmemcg_write_event_control() accesses the dentry->d_name of the specified\ncontrol fd to route the write call. As a cgroup interface file can't be\nrenamed, it's safe to access d_name as long as the specified file is a\nregular cgroup file. Also, as these cgroup interface files can't be\nremoved before the directory, it's safe to access the parent too.\n\nPrior to 347c4a874710 (\"memcg: remove cgroup_event->cft\"), there was a\ncall to __file_cft() which verified that the specified file is a regular\ncgroupfs file before further accesses. The cftype pointer returned from\n__file_cft() was no longer necessary and the commit inadvertently dropped\nthe file type check with it allowing any file to slip through. With the\ninvarients broken, the d_name and parent accesses can now race against\nrenames and removals of arbitrary files and cause use-after-free's.\n\nFix the bug by resurrecting the file type check in __file_cft(). Now that\ncgroupfs is implemented through kernfs, checking the file operations needs\nto go through a layer of indirection. Instead, let's check the superblock\nand dentry type." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:L - The bug is reached by writing to the cgroup v1 memory controller file cgroup.event_control via a local write syscall; it is not reachable from network packet processing or adjacent-link protocols.\nAC:L - The attacker fully controls both sides of the race—writing to event_control with an arbitrary control fd while concurrently renaming/unlinking that same file—so success does not depend on victim state or other conditions outside attacker influence.\nPR:L - cgroup.event_control is CFTYPE_WORLD_WRITABLE (S_IWUGO) with no capability check beyond opening the file, so an unprivileged local user in a reachable cgroup v1 memory hierarchy (Android, containers, hybrid mounts) can trigger it.\nUI:N - Exploitation requires only the attacker’s own syscalls (open/write/rename); no action by another user is needed.\nS:U - This is kernel memory corruption within the host kernel’s authority (local privilege escalation / crash), not a cross-boundary escape such as guest-to-host or IOMMU bypass.\nC:H - The defect is a use-after-free on dentry name/parent memory; UAF enables heap reuse and arbitrary read primitives for full confidentiality impact.\nI:H - The same UAF can be turned into heap spraying and write/control-flow primitives, enabling arbitrary kernel memory modification and code execution.\nA:H - Use-after-free of dentry name strings or parent dentries can cause kernel oops/panic even without a full exploit, so availability impact is high." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "include/linux/cgroup.h", "kernel/cgroup/cgroup-internal.h", "mm/memcontrol.c" ], "versions": [ { "version": "347c4a8747104a945ecced358944e42879176ca5", "lessThan": "b77600e26fd48727a95ffd50ba1e937efb548125", "status": "affected", "versionType": "git" }, { "version": "347c4a8747104a945ecced358944e42879176ca5", "lessThan": "e1ae97624ecf400ea56c238bff23e5cd139df0b8", "status": "affected", "versionType": "git" }, { "version": "347c4a8747104a945ecced358944e42879176ca5", "lessThan": "35963b31821920908e397146502066f6b032c917", "status": "affected", "versionType": "git" }, { "version": "347c4a8747104a945ecced358944e42879176ca5", "lessThan": "f1f7f36cf682fa59db15e2089039a2eeb58ff2ad", "status": "affected", "versionType": "git" }, { "version": "347c4a8747104a945ecced358944e42879176ca5", "lessThan": "aad8bbd17a1d586005feb9226c2e9cfce1432e13", "status": "affected", "versionType": "git" }, { "version": "347c4a8747104a945ecced358944e42879176ca5", "lessThan": "0ed074317b835caa6c03bcfa8f133365324673dc", "status": "affected", "versionType": "git" }, { "version": "347c4a8747104a945ecced358944e42879176ca5", "lessThan": "4a7ba45b1a435e7097ca0f79a847d0949d0eb088", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "include/linux/cgroup.h", "kernel/cgroup/cgroup-internal.h", "mm/memcontrol.c" ], "versions": [ { "version": "3.14", "status": "affected" }, { "version": "0", "lessThan": "3.14", "status": "unaffected", "versionType": "semver" }, { "version": "4.14.302", "lessThanOrEqual": "4.14.*", "status": "unaffected", "versionType": "semver" }, { "version": "4.19.269", "lessThanOrEqual": "4.19.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.4.227", "lessThanOrEqual": "5.4.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.10.159", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.15.83", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.0.13", "lessThanOrEqual": "6.0.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.1", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.14", "versionEndExcluding": "4.14.302" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.14", "versionEndExcluding": "4.19.269" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.14", "versionEndExcluding": "5.4.227" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.14", "versionEndExcluding": "5.10.159" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.14", "versionEndExcluding": "5.15.83" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.14", "versionEndExcluding": "6.0.13" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.14", "versionEndExcluding": "6.1" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/b77600e26fd48727a95ffd50ba1e937efb548125" }, { "url": "https://git.kernel.org/stable/c/e1ae97624ecf400ea56c238bff23e5cd139df0b8" }, { "url": "https://git.kernel.org/stable/c/35963b31821920908e397146502066f6b032c917" }, { "url": "https://git.kernel.org/stable/c/f1f7f36cf682fa59db15e2089039a2eeb58ff2ad" }, { "url": "https://git.kernel.org/stable/c/aad8bbd17a1d586005feb9226c2e9cfce1432e13" }, { "url": "https://git.kernel.org/stable/c/0ed074317b835caa6c03bcfa8f133365324673dc" }, { "url": "https://git.kernel.org/stable/c/4a7ba45b1a435e7097ca0f79a847d0949d0eb088" } ], "title": "memcg: fix possible use-after-free in memcg_write_event_control()", "x_generator": { "engine": "bippy-1.2.0" } }, "adp": [ { "metrics": [ { "other": { "type": "ssvc", "content": { "id": "CVE-2022-48988", "role": "CISA Coordinator", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "version": "2.0.3", "timestamp": "2024-10-22T13:16:57.577077Z" } } } ], "title": "CISA ADP Vulnrichment", "providerMetadata": { "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-10-22T13:18:42.631Z" } } ] } }