CVE-2022-49410
Published: 26 February 2025
Summary
CVE-2022-49410 is a high-severity Double Free (CWE-415) vulnerability in Linux Linux Kernel. Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 3.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 RA-5 (Vulnerability Monitoring and Scanning) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2022-49410 is a double free vulnerability (CWE-415) in the Linux kernel's tracing subsystem, specifically within the create_var_ref() function. The issue arises when init_var_ref() initializes fields of a variable reference allocated by create_hist_field(), but frees those fields (such as ref_field->system) on error. Subsequent error handling in the caller via destroy_hist_field() then frees the same fields and the variable itself, resulting in a double free. The vulnerability carries a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
A local attacker with low privileges can exploit this vulnerability due to its low attack complexity and lack of user interaction requirements. Successful exploitation could lead to high impacts on confidentiality, integrity, and availability, potentially allowing arbitrary code execution, data corruption, or system crashes through the double free in kernel memory management.
Mitigation involves applying the upstream kernel patches referenced in the stable repository commits, such as 058cb6d86b9789377216c936506b346aaa1eb581, 37443b3508b8cce6832f8d25cb4550b2f7801f50, 4fdfb15e08598711dbf50daf56a33965232daf0e, 99696a2592bca641eb88cc9a80c90e591afebd0f, and bd83ff3bbfb003832481c9bff999d12385f396ae. These patches resolve the issue by storing NULL in the corresponding fields when they are freed within init_var_ref(), preventing the double free during subsequent cleanup.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-54819
Vulnerability details
In the Linux kernel, the following vulnerability has been resolved: tracing: Fix potential double free in create_var_ref() In create_var_ref(), init_var_ref() is called to initialize the fields of variable ref_field, which is allocated in the previous function call to create_hist_field(). Function…
more
init_var_ref() allocates the corresponding fields such as ref_field->system, but frees these fields when the function encounters an error. The caller later calls destroy_hist_field() to conduct error handling, which frees the fields and the variable itself. This results in double free of the fields which are already freed in the previous function. Fix this by storing NULL to the corresponding fields when they are freed in init_var_ref().
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Double-free memory corruption in kernel tracing subsystem directly enables local exploitation for privilege escalation to achieve arbitrary code execution or full system compromise.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly mandates timely remediation of the double free vulnerability in the Linux kernel tracing subsystem by applying upstream patches.
Requires receiving and acting on security advisories for CVEs like CVE-2022-49410 to initiate patching of affected kernel versions.
Enables vulnerability scanning to identify systems running Linux kernel versions susceptible to CVE-2022-49410.