CVE-2022-49388
Published: 26 February 2025
Summary
CVE-2022-49388 is a high-severity Use After Free (CWE-416) vulnerability in Linux Linux Kernel. Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 3.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-2 (Flaw Remediation) and RA-5 (Vulnerability Monitoring and Scanning).
Deeper analysis
CVE-2022-49388 is a use-after-free vulnerability in the Linux kernel's UBI (Unsorted Block Images) subsystem, specifically within the ubi_create_volume() function during error handling paths when volume creation fails. The issue occurs with the 'eba_tbl' structure: it is updated in vol->eba_tbl during ubi_eba_replace_table(), then freed in ubi_eba_destroy_table(), but subsequently accessed again in vol_release() via kfree(tbl->entries), leading to a use-after-free condition classified under CWE-416. This affects Linux kernel versions prior to the application of the relevant stable patches.
A local attacker with low privileges (PR:L) can exploit this vulnerability with low attack complexity (AC:L) and no user interaction required (UI:N), as indicated by the CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Successful exploitation could allow the attacker to achieve high impacts on confidentiality, integrity, and availability, potentially enabling arbitrary code execution, data corruption, or system crashes through manipulation of the freed memory in the UBI volume creation process.
Mitigation is provided through upstream Linux kernel stable patches, available in the following commits: 1174ab8ba36a48025b68b5ff1085000b1e510217, 25ff1e3a1351c0d936dd1ac2f9e58231ea1510c9, 5ff2514e4fb55dcf3d88294686040ca73ea0c1a2, 6d8d3f68cbecfd31925796f0fb668eb21ab06734, and 8302620aeb940f386817321d272b12411ae7d39f. These patches fix the issue by removing the redundant release of 'eba_tbl' to prevent the use-after-free during error paths. Security practitioners should ensure systems using UBI are updated to kernels incorporating these fixes.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-54841
Vulnerability details
In the Linux kernel, the following vulnerability has been resolved: ubi: ubi_create_volume: Fix use-after-free when volume creation failed There is an use-after-free problem for 'eba_tbl' in ubi_create_volume()'s error handling path: ubi_eba_replace_table(vol, eba_tbl) vol->eba_tbl = tbl out_mapping: ubi_eba_destroy_table(eba_tbl) // Free 'eba_tbl'…
more
out_unlock: put_device(&vol->dev) vol_release kfree(tbl->entries) // UAF Fix it by removing redundant 'eba_tbl' releasing. Fetch a reproducer in [Link].
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Local kernel use-after-free in UBI volume creation directly enables exploitation for privilege escalation to achieve arbitrary code execution or system compromise from low-privileged context.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly remediates the use-after-free vulnerability by applying upstream Linux kernel patches to eliminate the flaw in UBI volume creation error handling.
Kernel memory protections such as address randomization and executable space protection mitigate exploitation of the use-after-free condition even if unpatched.
Vulnerability scanning identifies systems with vulnerable kernel versions affected by CVE-2022-49388, enabling targeted remediation.