{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2022-50423", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2025-09-17T14:53:07.004Z", "datePublished": "2025-10-01T11:41:56.083Z", "dateUpdated": "2026-08-05T08:58:45.759Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T08:58:45.759Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nACPICA: Fix use-after-free in acpi_ut_copy_ipackage_to_ipackage()\n\nThere is an use-after-free reported by KASAN:\n\n BUG: KASAN: use-after-free in acpi_ut_remove_reference+0x3b/0x82\n Read of size 1 at addr ffff888112afc460 by task modprobe/2111\n CPU: 0 PID: 2111 Comm: modprobe Not tainted 6.1.0-rc7-dirty\n Hardware name: QEMU Standard PC (i440FX + PIIX, 1996),\n Call Trace:\n \n kasan_report+0xae/0xe0\n acpi_ut_remove_reference+0x3b/0x82\n acpi_ut_copy_iobject_to_iobject+0x3be/0x3d5\n acpi_ds_store_object_to_local+0x15d/0x3a0\n acpi_ex_store+0x78d/0x7fd\n acpi_ex_opcode_1A_1T_1R+0xbe4/0xf9b\n acpi_ps_parse_aml+0x217/0x8d5\n ...\n \n\nThe root cause of the problem is that the acpi_operand_object\nis freed when acpi_ut_walk_package_tree() fails in\nacpi_ut_copy_ipackage_to_ipackage(), lead to repeated release in\nacpi_ut_copy_iobject_to_iobject(). The problem was introduced\nby \"8aa5e56eeb61\" commit, this commit is to fix memory leak in\nacpi_ut_copy_iobject_to_iobject(), repeatedly adding remove\noperation, lead to \"acpi_operand_object\" used after free.\n\nFix it by removing acpi_ut_remove_reference() in\nacpi_ut_copy_ipackage_to_ipackage(). acpi_ut_copy_ipackage_to_ipackage()\nis called to copy an internal package object into another internal\npackage object, when it fails, the memory of acpi_operand_object\nshould be freed by the caller." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:L - The UAF is in the ACPICA AML interpreter (`acpi_ut_copy_ipackage_to_ipackage` during Store-to-Local), reached only via local ACPI table load or control-method evaluation; there is no network or adjacent-packet path into this code.\nAC:L - Once a firmware method Stores a shared package to a Local/Arg, the attacker can deterministically force the mid-walk AE_NO_MEMORY failure that triggers the double-free by exhausting memcg-accounted GFP_KERNEL allocations in the same process context that evaluates the method (e.g. container memory.max); no race or attacker-uncontrollable layout is required.\nPR:L - Unprivileged local users can drive ACPI method evaluation through world-readable ACPI/thermal/power sysfs attributes (0444) with no capability check; root-only interfaces such as configfs SSDT load or custom_method are not required on firmware that already Stores packages during those methods.\nUI:N - The attacker triggers evaluation directly via their own sysfs reads under memory pressure; no separate victim action such as mounting a filesystem is required.\nS:U - Impact is a host-kernel slab use-after-free within the same OS security authority; there is no VM escape, IOMMU bypass, or other cross-boundary compromise.\nC:H - The second `acpi_ut_remove_reference()` reads the already-freed Acpi-Operand object (as KASAN reported); reclaim/spray of that slab object yields an attacker-controlled read primitive, so confidentiality is High per UAF guidance.\nI:H - The same double-free of the package operand object is a classic heap UAF/double-free that enables spray-based arbitrary write and control-flow hijack primitives, so integrity is High.\nA:H - The bug was reported as a KASAN use-after-free and any second free or reuse of the dangling operand readily oopses/panics the kernel; per guidance any UAF is Availability High." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/acpi/acpica/utcopy.c" ], "versions": [ { "version": "8aa5e56eeb61a099ea6519eb30ee399e1bc043ce", "lessThan": "133462d35dae95edb944af86b986d4c9dec59bd1", "status": "affected", "versionType": "git" }, { "version": "8aa5e56eeb61a099ea6519eb30ee399e1bc043ce", "lessThan": "02f237423c9c6a18e062de2d474f85d5659e4eb9", "status": "affected", "versionType": "git" }, { "version": "8aa5e56eeb61a099ea6519eb30ee399e1bc043ce", "lessThan": "c9125b643fc51b8e662f2f614096ceb45a0adbc3", "status": "affected", "versionType": "git" }, { "version": "8aa5e56eeb61a099ea6519eb30ee399e1bc043ce", "lessThan": "dfdde4d5138bc023897033a5ac653a84e94805be", "status": "affected", "versionType": "git" }, { "version": "8aa5e56eeb61a099ea6519eb30ee399e1bc043ce", "lessThan": "02617006b5a46f2ea55ac61f5693c7afd7bf9276", "status": "affected", "versionType": "git" }, { "version": "8aa5e56eeb61a099ea6519eb30ee399e1bc043ce", "lessThan": "6fde666278f91b85d71545a0ebbf41d8d7af8074", "status": "affected", "versionType": "git" }, { "version": "8aa5e56eeb61a099ea6519eb30ee399e1bc043ce", "lessThan": "f51b2235e4f320edc839c3e5cb0d1f8a6e8657c6", "status": "affected", "versionType": "git" }, { "version": "8aa5e56eeb61a099ea6519eb30ee399e1bc043ce", "lessThan": "01f2c2052ea50fb9a8ce12e4e83aed0267934ef0", "status": "affected", "versionType": "git" }, { "version": "8aa5e56eeb61a099ea6519eb30ee399e1bc043ce", "lessThan": "470188b09e92d83c5a997f25f0e8fb8cd2bc3469", "status": "affected", "versionType": "git" }, { "version": "b3e98f0c4f996cd53b80bad71f0d7e4a2cf3a4e8", "status": "affected", "versionType": "git" }, { "version": "7af5504c102a378376101dbd160246b10a814dd0", "status": "affected", "versionType": "git" }, { "version": "e29a15484d7ea949e49ae7fb7e576a575da824a6", "status": "affected", "versionType": "git" }, { "version": "e2ab6731a36966d042a2d4dabd980496cd680f75", "status": "affected", "versionType": "git" }, { "version": "3.10.55", "lessThan": "3.11", "status": "affected", "versionType": "semver" }, { "version": "3.12.29", "lessThan": "3.13", "status": "affected", "versionType": "semver" }, { "version": "3.14.19", "lessThan": "3.15", "status": "affected", "versionType": "semver" }, { "version": "3.16.3", "lessThan": "3.17", "status": "affected", "versionType": "semver" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/acpi/acpica/utcopy.c" ], "versions": [ { "version": "3.17", "status": "affected" }, { "version": "0", "lessThan": "3.17", "status": "unaffected", "versionType": "semver" }, { "version": "4.9.337", "lessThanOrEqual": "4.9.*", "status": "unaffected", "versionType": "semver" }, { "version": "4.14.303", "lessThanOrEqual": "4.14.*", "status": "unaffected", "versionType": "semver" }, { "version": "4.19.270", "lessThanOrEqual": "4.19.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.4.229", "lessThanOrEqual": "5.4.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.10.163", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.15.86", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.0.16", "lessThanOrEqual": "6.0.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.1.2", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.2", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.17", "versionEndExcluding": "4.9.337" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.17", "versionEndExcluding": "4.14.303" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.17", "versionEndExcluding": "4.19.270" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.17", "versionEndExcluding": "5.4.229" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.17", "versionEndExcluding": "5.10.163" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.17", "versionEndExcluding": "5.15.86" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.17", "versionEndExcluding": "6.0.16" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.17", "versionEndExcluding": "6.1.2" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.17", "versionEndExcluding": "6.2" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.10.55" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.12.29" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.14.19" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.16.3" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/133462d35dae95edb944af86b986d4c9dec59bd1" }, { "url": "https://git.kernel.org/stable/c/02f237423c9c6a18e062de2d474f85d5659e4eb9" }, { "url": "https://git.kernel.org/stable/c/c9125b643fc51b8e662f2f614096ceb45a0adbc3" }, { "url": "https://git.kernel.org/stable/c/dfdde4d5138bc023897033a5ac653a84e94805be" }, { "url": "https://git.kernel.org/stable/c/02617006b5a46f2ea55ac61f5693c7afd7bf9276" }, { "url": "https://git.kernel.org/stable/c/6fde666278f91b85d71545a0ebbf41d8d7af8074" }, { "url": "https://git.kernel.org/stable/c/f51b2235e4f320edc839c3e5cb0d1f8a6e8657c6" }, { "url": "https://git.kernel.org/stable/c/01f2c2052ea50fb9a8ce12e4e83aed0267934ef0" }, { "url": "https://git.kernel.org/stable/c/470188b09e92d83c5a997f25f0e8fb8cd2bc3469" } ], "title": "ACPICA: Fix use-after-free in acpi_ut_copy_ipackage_to_ipackage()", "x_generator": { "engine": "bippy-1.2.0" } }, "adp": [ { "metrics": [ { "cvssV3_1": { "scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH" } }, { "other": { "type": "ssvc", "content": { "id": "CVE-2022-50423", "role": "CISA Coordinator", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "total" } ], "version": "2.0.3", "timestamp": "2026-01-14T17:39:57.539191Z" } } } ], "problemTypes": [ { "descriptions": [ { "lang": "en", "type": "CWE", "cweId": "CWE-416", "description": "CWE-416 Use After Free" } ] } ], "title": "CISA ADP Vulnrichment", "providerMetadata": { "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-14T17:42:46.653Z" } } ] } }