Vulnerability Details CVE-2022-50433
In the Linux kernel, the following vulnerability has been resolved:
efi: ssdt: Don't free memory if ACPI table was loaded successfully
Amadeusz reports KASAN use-after-free errors introduced by commit
3881ee0b1edc ("efi: avoid efivars layer when loading SSDTs from
variables"). The problem appears to be that the memory that holds the
new ACPI table is now freed unconditionally, instead of only when the
ACPI core reported a failure to load the table.
So let's fix this, by omitting the kfree() on success.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.001
EPSS Ranking 4.1%
CVSS Severity
CVSS v3 Score 7.8
References
Products affected by CVE-2022-50433
-
cpe:2.3:o:linux:linux_kernel:6.0
-
cpe:2.3:o:linux:linux_kernel:6.0.1
-
cpe:2.3:o:linux:linux_kernel:6.0.2
-
cpe:2.3:o:linux:linux_kernel:6.0.3
-
cpe:2.3:o:linux:linux_kernel:6.1