CVE-2022-49053
Published: 26 February 2025
Summary
CVE-2022-49053 is a high-severity Use After Free (CWE-416) vulnerability in Linux Linux Kernel. Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 2.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 RA-5 (Vulnerability Monitoring and Scanning) and SI-16 (Memory Protection).
Deeper analysis
CVE-2022-49053 is a use-after-free (UAF) vulnerability in the Linux kernel's SCSI target tcmu (target core multi-user) component. The issue arises in the tcmu_try_get_data_page() function, which looks up pages under cmdr_lock but fails to properly increment the page refcount before returning the page pointer. As a result, the page may be concurrently freed by tcmu_blocks_release() after the function returns, leading to a potential UAF condition. This flaw is classified under CWE-416 and carries a CVSS v3.1 base score of 7.8.
A local attacker with low privileges can exploit this vulnerability due to its low attack complexity, local access vector, and lack of required user interaction. Successful exploitation could result in high impacts on confidentiality, integrity, and availability, potentially allowing arbitrary code execution, data corruption, or system crashes within the kernel context.
Mitigation involves applying the relevant stable kernel patches, as detailed in the provided commit references. These patches resolve the issue by ensuring get_page() is called under cmdr_lock to properly handle refcounts and prevent concurrent freeing by tcmu_blocks_release(). Systems running affected Linux kernel versions with tcmu enabled should update to a patched kernel.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-55151
Vulnerability details
In the Linux kernel, the following vulnerability has been resolved: scsi: target: tcmu: Fix possible page UAF tcmu_try_get_data_page() looks up pages under cmdr_lock, but it does not take refcount properly and just returns page pointer. When tcmu_try_get_data_page() returns, the returned…
more
page may have been freed by tcmu_blocks_release(). We need to get_page() under cmdr_lock to avoid concurrent tcmu_blocks_release().
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Local kernel UAF in tcmu enables privilege escalation via arbitrary code execution in kernel context.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires timely identification, reporting, and correction of flaws like this kernel UAF vulnerability via patching to prevent exploitation.
Implements runtime memory safeguards that protect against unauthorized access or execution resulting from use-after-free conditions in kernel components like tcmu.
Mandates vulnerability scanning to identify known issues like CVE-2022-49053 in affected Linux kernel versions for prompt remediation.