CVE-2022-49377
Published: 26 February 2025
Summary
CVE-2022-49377 is a high-severity Use After Free (CWE-416) vulnerability in Linux Linux Kernel. Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 22.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-2 (Flaw Remediation) and RA-5 (Vulnerability Monitoring and Scanning).
Deeper analysis
CVE-2022-49377 is a use-after-free vulnerability (CWE-416) in the Linux kernel's blk-mq (block multi-queue) subsystem. The flaw arises in the blk_mq_get_sq_hctx function, which accesses the ->tagset pointer even after it may have been freed. This occurs when blk_mq_run_hw_queues is invoked without queued requests following queue cleanup via blk_cleanup_queue, as the tagset lifetime is managed by the driver and often freed post-cleanup. The vulnerability has a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and affects Linux kernel versions prior to the patched releases.
A local attacker with low privileges can exploit this vulnerability with low attack complexity and no user interaction required. Exploitation involves triggering the use-after-free condition during blk-mq operations, potentially leading to high impacts on confidentiality, integrity, and availability, such as arbitrary code execution, data corruption, or kernel crashes.
Mitigation requires applying upstream patches from the Linux kernel stable repositories. Relevant fixes include commits 460aa288c5cd0544dcf933a2f0ad0e8c6d2d35ff, 5d05426e2d5fd7df8afc866b78c36b37b00188b7, 70fdd922c7bf8949f8df109cf2635dff64c90392, and b140bac470b4f707cda59c7266214246238661df, which modify blk_mq_get_sq_hctx to avoid accessing ->tagset and instead use the request queue's mapping for default hctx determination, preventing the use-after-free while maintaining performance.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-54852
Vulnerability details
In the Linux kernel, the following vulnerability has been resolved: blk-mq: don't touch ->tagset in blk_mq_get_sq_hctx blk_mq_run_hw_queues() could be run when there isn't queued request and after queue is cleaned up, at that time tagset is freed, because tagset lifetime…
more
is covered by driver, and often freed after blk_cleanup_queue() returns. So don't touch ->tagset for figuring out current default hctx by the mapping built in request queue, so use-after-free on tagset can be avoided. Meantime this way should be fast than retrieving mapping from tagset.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Local kernel UAF in blk-mq directly enables privilege escalation via arbitrary code execution from low-privileged context.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires timely remediation of the use-after-free flaw in the Linux kernel's blk-mq subsystem via application of upstream patches.
Vulnerability scanning identifies Linux kernel versions affected by CVE-2022-49377, enabling prioritization for patching.
Ensures receipt and dissemination of security advisories regarding kernel vulnerabilities like CVE-2022-49377 to support flaw detection and remediation.