CVE-2022-50560
BaseFortify
Publication date: 2025-10-22
Last updated on: 2025-10-22
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux | linux_kernel | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-UNKNOWN |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a use-after-free bug in the Linux kernel's drm/meson driver. When the meson_drm module is unloaded, a cleanup function (component_master_del) was not called, causing the aggregate device to remain in a global list. Later, when the meson_dw_hdmi module is reloaded, it tries to access this stale aggregate device, which points to memory that has already been freed. This leads to a use-after-free condition, potentially causing kernel crashes or undefined behavior.
How can this vulnerability impact me? :
This vulnerability can cause system instability or crashes due to the use-after-free bug in the kernel. It may lead to denial of service if the kernel crashes or behaves unpredictably when the affected modules are unloaded and reloaded. Exploitation could potentially allow an attacker to execute arbitrary code or escalate privileges, depending on the system context.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by monitoring kernel logs for use-after-free bugs related to the meson_drm and meson_dw_hdmi modules. Specifically, look for KASAN (Kernel Address Sanitizer) error messages in dmesg or journalctl logs that mention 'use-after-free in find_components' or similar stack traces involving meson_dw_hdmi and meson_drm. Commands to check include: 'dmesg | grep -i kasan' or 'journalctl -k | grep -i kasan'.
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation involves updating the Linux kernel to a version where the vulnerability is fixed, which includes the patch that explicitly removes the aggregate driver at module unload time to prevent the use-after-free condition. Until an update is applied, avoid unloading and reloading the meson_dw_hdmi and meson_drm modules to prevent triggering the bug.