CVE-2022-2585 Use after free in linux

Medium 5.3 Published 8 Jan 2024 Updated 4 Sep 2024

A use-after-free in the Linux kernel allows local attackers to execute arbitrary code or escalate privileges via POSIX CPU timers.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Local or same network only
Victim action needed: Not needed
Fix: Available

What is CVE-2022-2585?

CVE-2022-2585 is a medium-severity use after free vulnerability in Canonical Ubuntu Linux, published on 8 Jan 2024. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

It was discovered that when exec'ing from a non-leader thread, armed POSIX CPU timers would be left on a list but freed, leading to a use-after-free.

Weakness: CWE-416

Which versions are affected by CVE-2022-2585?

It affects 2 products.

Linux distribution packages (12)

`kpatch-patch-5_14_0-70_13_1` Red Hat:enterprise_linux:9::baseos	All versions	`0:1-4.el9_0`
`kpatch-patch-5_14_0-70_13_1-debuginfo` Red Hat:enterprise_linux:9::baseos	All versions	`0:1-4.el9_0`
`kpatch-patch-5_14_0-70_13_1-debugsource` Red Hat:enterprise_linux:9::baseos	All versions	`0:1-4.el9_0`
`kpatch-patch-5_14_0-70_17_1` Red Hat:enterprise_linux:9::baseos	All versions	`0:1-3.el9_0`
`kpatch-patch-5_14_0-70_17_1-debuginfo` Red Hat:enterprise_linux:9::baseos	All versions	`0:1-3.el9_0`
`kpatch-patch-5_14_0-70_17_1-debugsource` Red Hat:enterprise_linux:9::baseos	All versions	`0:1-3.el9_0`
`kpatch-patch-5_14_0-70_22_1` Red Hat:enterprise_linux:9::baseos	All versions	`0:1-3.el9_0`
`kpatch-patch-5_14_0-70_22_1-debuginfo` Red Hat:enterprise_linux:9::baseos	All versions	`0:1-3.el9_0`
`kpatch-patch-5_14_0-70_22_1-debugsource` Red Hat:enterprise_linux:9::baseos	All versions	`0:1-3.el9_0`
`kpatch-patch-5_14_0-70_26_1` Red Hat:enterprise_linux:9::baseos	All versions	`0:1-2.el9_0`
`kpatch-patch-5_14_0-70_26_1-debuginfo` Red Hat:enterprise_linux:9::baseos	All versions	`0:1-2.el9_0`
`kpatch-patch-5_14_0-70_26_1-debugsource` Red Hat:enterprise_linux:9::baseos	All versions	`0:1-2.el9_0`

Products include Canonical Ubuntu Linux, Linux kernel.

How do I fix CVE-2022-2585?

Apply the vendor's patch.

Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.

Is CVE-2022-2585 being exploited?

There is no known exploitation of CVE-2022-2585 in the wild and no public exploit code.

All Canonical Ubuntu Linux vulnerabilities

Sources

Also known as AZL-33498, DEBIAN-CVE-2022-2585, RHSA-2022:7330, UBUNTU-CVE-2022-2585.