CVE-2022-23090 AIO credential reference count leak

High 7.7 Published 15 Feb 2024 Updated 28 Mar 2025

An attacker can trigger a use-after-free in the FreeBSD kernel via aio_aqueue, potentially leading to code execution or privilege escalation.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Local or same network only
Victim action needed: Not needed
Fix: None listed

What is CVE-2022-23090?

CVE-2022-23090 is a high-severity use after free vulnerability in Freebsd Freebsd, published on 15 Feb 2024. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

The aio_aqueue function, used by the lio_listio system call, fails to release a reference to a credential in an error case.

An attacker may cause the reference count to overflow, leading to a use after free (UAF).

Weakness: CWE-416

Which versions are affected by CVE-2022-23090?

It affects 1 product.

Products include Freebsd Freebsd.

How do I fix CVE-2022-23090?

No fix has been published for CVE-2022-23090 yet. Limit exposure of the affected software until one is available.

Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.

Is CVE-2022-23090 being exploited?

There is no known exploitation of CVE-2022-23090 in the wild and no public exploit code.

All Freebsd Freebsd vulnerabilities

Sources

Also known as GHSA-3q8j-579q-jx44.