CVE-2022-4382 Use after free in Linux kernel
A use-after-free race condition in the Linux kernel gadgetfs driver allows local attackers to potentially execute code or escalate privileges by physically disconnecting a device.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-4382?
CVE-2022-4382 is a medium-severity use after free vulnerability in Linux kernel, published on 10 Jan 2023. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
A use-after-free flaw caused by a race among the superblock operations in the gadgetfs Linux driver was found. It could be triggered by yanking out a device that is running the gadgetfs side.
Weakness: CWE-416
Which versions are affected by CVE-2022-4382?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2022-4382?
Apply the vendor's patch.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2022-4382 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2022-4382 exists.
Other vulnerabilities in Linux kernel
Sources
Also known as DEBIAN-CVE-2022-4382, GHSA-xfq3-69mc-84pr, UBUNTU-CVE-2022-4382.