CVE-2022-48950·Kernel vulnerability
In the Linux kernel, the following vulnerability has been resolved: perf: Fix perf_pending_task() UaF Per syzbot it is possible for perf_pending_task() to run after the event is free()'d. There are two related but distinct cases: - the task_work was already queued before destroying the event; - destroying the event itself queues the task_work. The first cannot be solved using task_work_cancel() since perf_release() itself might be called from a task_work (____fput), which means the current->task_works list is already empty and task_work_cancel() won't be able to find the perf_pending_task() entry. The simplest alternative is extending the perf_event lifetime to cover the task_work. The second is just silly, queueing a task_work while you know the event is going away makes no sense and is easily avoided by re-arranging how the event is marked STATE_DEAD and ensuring it goes through STATE_OFF on the way down.
- Severity
- high
- Software
- Kernel
- Fixed in
- 6.0.14
- Published
- 2024-10-21
Affected versions
From: 5.16
Until: 6.0.14
Fixed in: 6.0.14
How to fix this CVE
Update your Linux kernel to version 6.0.14 or later to resolve a use-after-free vulnerability in the perf event handling subsystem. This vulnerability allows a freed perf event to be accessed during asynchronous task work cleanup, potentially leading to kernel crashes or privilege escalation. Systems running kernel versions 5.16 through 6.0.13 should prioritize this patch and reboot after updating.
sudo dnf update kernel && sudo rebootDefensia detects this vulnerability
How to check if you are affected
- Run 'uname -r' to check your current kernel version and compare against the vulnerable range (5.16.x through 6.0.13)
- Verify perf event subsystem is enabled by checking 'cat /boot/config-$(uname -r) | grep CONFIG_PERF_EVENTS' — if it returns 'CONFIG_PERF_EVENTS=y', the subsystem is active
- Search kernel logs for perf-related crashes with 'dmesg | grep -i perf' or 'journalctl -xe | grep -i perf' to identify potential exploitation attempts
- After patching, confirm the new kernel is running with 'uname -r' and verify it matches 6.0.14 or later
FAQ
What is CVE-2022-48950?
CVE-2022-48950 is a use-after-free vulnerability in the Linux kernel's perf (performance monitoring) event subsystem where asynchronous task work can attempt to access a performance event after it has been freed from memory, resulting in kernel instability or potential privilege escalation.
Is CVE-2022-48950 being actively exploited?
No, there is no public evidence of active exploitation in the wild. This vulnerability was discovered through fuzzing (syzbot) and is not listed on CISA's Known Exploited Vulnerabilities catalog.
What versions of Kernel are affected by CVE-2022-48950?
Linux kernel versions 5.16.0 through 6.0.13 are affected. The vulnerability was fixed in kernel 6.0.14 and later stable releases.
How do I check if my server is vulnerable to CVE-2022-48950?
Run 'uname -r' and compare your kernel version against 5.16.0 to 6.0.13. If your version falls within this range, your system is vulnerable and requires a kernel update.
Does Defensia detect CVE-2022-48950?
Yes — Defensia's CVE advisory scanner compares installed package versions against the NVD database. If Kernel is installed on a monitored server, CVE-2022-48950 will appear in your dashboard with remediation steps.
Related Kernel CVEs
References
Track CVEs across your fleet automatically
Defensia scans your Linux servers and tells you exactly which ones are running vulnerable versions — including CVE-2022-48950. Free for 1 server.
Get started free