CVE-2022-49411
Last modified
CVE-2022-49411 is a high-severity vulnerability rated 7.8/10 on the CVSS scale. In the Linux kernel, the following vulnerability has been resolved: bfq: Make sure bfqg for which we are queueing requests is online Bios queued into BFQ IO scheduler can be associated with a cgroup that was already offlined. This may then cause insertion of this bfq_group into a service tree. EPSS estimates a 0.27% chance of exploitation in the next 30 days.
Description
In the Linux kernel, the following vulnerability has been resolved: bfq: Make sure bfqg for which we are queueing requests is online Bios queued into BFQ IO scheduler can be associated with a cgroup that was already offlined. This may then cause insertion of this bfq_group into a service tree. But this bfq_group will get freed as soon as last bio associated with it is completed leading to use after free issues for service tree users. Fix the problem by making sure we always operate on online bfq_group. If the bfq_group associated with the bio is not online, we pick the first online parent.
Metrics
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Linux | Linux Kernel | >= 4.12, < 5.4.198 |
| Linux | Linux Kernel | >= 5.5, < 5.10.121 |
| Linux | Linux Kernel | >= 5.11, < 5.15.46 |
| Linux | Linux Kernel | >= 5.16, < 5.17.14 |
| Linux | Linux Kernel | >= 5.18, < 5.18.3 |
References
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2022-49411?
How severe is CVE-2022-49411?
How do I fix CVE-2022-49411?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2022
- CVE-2022-49406In the Linux kernel, the following vulnerability has been re…5.5
- CVE-2022-49407In the Linux kernel, the following vulnerability has been re…7.1
- CVE-2022-49408In the Linux kernel, the following vulnerability has been re…5.5
- CVE-2022-49409In the Linux kernel, the following vulnerability has been re…5.5
- CVE-2022-4941The WCFM Membership plugin for WordPress is vulnerable to Cr…8.8
- CVE-2022-49410In the Linux kernel, the following vulnerability has been re…7.8
- CVE-2022-49412In the Linux kernel, the following vulnerability has been re…7.8
- CVE-2022-49413In the Linux kernel, the following vulnerability has been re…7.8
- CVE-2022-49414In the Linux kernel, the following vulnerability has been re…4.7
- CVE-2022-49415In the Linux kernel, the following vulnerability has been re…5.5
- CVE-2022-49416In the Linux kernel, the following vulnerability has been re…8.8
- CVE-2022-49417In the Linux kernel, the following vulnerability has been re…5.5
Are you affected by CVE-2022-49411?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST