CVE-2022-49275

March 4, 2025, 6:15 p.m.

7.8
High

Description

In the Linux kernel, the following vulnerability has been resolved: can: m_can: m_can_tx_handler(): fix use after free of skb can_put_echo_skb() will clone skb then free the skb. Move the can_put_echo_skb() for the m_can version 3.0.x directly before the start of the xmit in hardware, similar to the 3.1.x branch.

Product(s) Impacted

Product Versions
Linux kernel
  • ['3.0.x']

Weaknesses

Common security weaknesses mapped to this vulnerability.

CWE-416
Use After Free
Referencing memory after it has been freed can cause a program to crash, use unexpected values, or execute code.

References

https://git.kernel.org/stable/c/08d90846e438ac22dc56fc49ec0b0d195831c5ed
https://git.kernel.org/stable/c/2e8e79c416aae1de224c0f1860f2e3350fa171f8
https://git.kernel.org/stable/c/31417073493f302d26ab66b3abc098d43227b835
https://git.kernel.org/stable/c/4db7d6f481990dd179a9ee7126dc7aa31ea4fff3
https://git.kernel.org/stable/c/7728d937ec403a1ceff9483023252d2cb8777f81
https://git.kernel.org/stable/c/869016a2938ac44f7b2fb7fc22c89edad99eb9b3
https://git.kernel.org/stable/c/d3892a747ab16b1eb6593a19d29f62c3b3f020ac
https://git.kernel.org/stable/c/d93ed9aff64968f4cdad690712eb4f48ae537bde
https://git.kernel.org/stable/c/f43e64076ff1b1dcb893fb77ad1204105f710a29

Tags

416baaa9-dc9f-4396-8d5f-8c081fb06d67
CWE-416
2025-02-26
CVE-2022-49275

CVSS Score

7.8 / 10

CVSS Data - 3.1

  • Attack Vector: LOCAL
  • Attack Complexity: LOW
  • Privileges Required: LOW
  • Scope: UNCHANGED
  • Confidentiality Impact: HIGH
  • Integrity Impact: HIGH
  • Availability Impact: HIGH

    • CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

    View Vector String

Timeline

Published: Feb. 26, 2025, 7:01 a.m.
Last Modified: March 4, 2025, 6:15 p.m.

Status : Awaiting Analysis

CVE has been recently published to the CVE List and has been received by the NVD.

More info

Source

416baaa9-dc9f-4396-8d5f-8c081fb06d67

*Disclaimer: Some vulnerabilities do not have an associated CPE. To enhance the data, we use AI to infer CPEs based on CVE details. This is an automated process and might not always be accurate.