In the Linux kernel, the following vulnerability has been resolved: scsi: libfc: Fix use after free in fc_exch_abts_resp() fc_exch_release(ep) will decrease the ep's reference count. When the reference count reaches zero, it is freed. But ep is still used in the following code, which will lead to a use after free. Return after the fc_exch_release() call to avoid use after free.

Metrics

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact total

Affected Vendors & Products

No data.

No data.

No data.

References
Link Providers
https://git.kernel.org/stable/c/1d7effe5fff9d28e45e18ac3a564067c7ddfe898 cve-icon cve-icon
https://git.kernel.org/stable/c/271add11994ba1a334859069367e04d2be2ebdd4 cve-icon cve-icon
https://git.kernel.org/stable/c/412dd8299b02e4410fe77b8396953c1a8dde183a cve-icon cve-icon
https://git.kernel.org/stable/c/499d198494e77b6533251b9b909baf5c101129cb cve-icon cve-icon
https://git.kernel.org/stable/c/4a131d4ea8b581ac9b01d3a72754db4848be3232 cve-icon cve-icon
https://git.kernel.org/stable/c/5cf2ce8967b0d98c8cfa4dc42ef4fcf080f5c836 cve-icon cve-icon
https://git.kernel.org/stable/c/6044ad64f41c87382cfeeca281573d1886d80cbe cve-icon cve-icon
https://git.kernel.org/stable/c/87909291762d08fdb60d19069d7a89b5b308d0ef cve-icon cve-icon
https://git.kernel.org/stable/c/f581df412bc45c95176e3c808ee2839c05b2ab0c cve-icon cve-icon
https://lore.kernel.org/linux-cve-announce/2025022602-CVE-2022-49114-86bb@gregkh/T cve-icon
https://nvd.nist.gov/vuln/detail/CVE-2022-49114 cve-icon
https://www.cve.org/CVERecord?id=CVE-2022-49114 cve-icon
History

Tue, 04 Mar 2025 18:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-416
Metrics cvssV3_1

{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}

 ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

cvssV3_1

{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}

Thu, 27 Feb 2025 01:45:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

 cvssV3_1

{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}

threat_severity

Moderate

Wed, 26 Feb 2025 02:15:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: scsi: libfc: Fix use after free in fc_exch_abts_resp() fc_exch_release(ep) will decrease the ep's reference count. When the reference count reaches zero, it is freed. But ep is still used in the following code, which will lead to a use after free. Return after the fc_exch_release() call to avoid use after free.
Title scsi: libfc: Fix use after free in fc_exch_abts_resp()
References
cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2025-02-26T01:54:58.172Z

Updated: 2025-03-04T18:07:17.816Z

Reserved: 2025-02-26T01:49:39.262Z

Link: CVE-2022-49114

cve-icon Vulnrichment

Updated: 2025-03-04T18:03:28.399Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2025-02-26T07:00:48.773

Modified: 2025-03-04T18:15:21.570

Link: CVE-2022-49114

cve-icon Redhat

Severity : Moderate

Publid Date: 2025-02-26T00:00:00Z

Links: CVE-2022-49114 - Bugzilla