CVE-2022-41218

MEDIUM

Linux kernel <5.19.10 - Use After Free

Title source: llm

Description

In drivers/media/dvb-core/dmxdev.c in the Linux kernel through 5.19.10, there is a use-after-free caused by refcount races, affecting dvb_demux_open and dvb_dmxdev_release.

Exploits (2)

nomisec WORKING POC

by Tobey123 · poc

https://github.com/Tobey123/CVE-2022-41218

View Code ZIP pw:eip

inthewild

poc

https://github.com/v4bel/cve-2022-41218

View on inthewild

References (9)

[Mailing List] https://lore.kernel.org/all/20220908132754.30532-1-tiwai%40suse.de/

[Exploit, Mailing List, Third Party Advisory] http://www.openwall.com/lists/oss-security/2022/09/23/4

[Exploit, Mailing List, Third Party Advisory] http://www.openwall.com/lists/oss-security/2022/09/24/1

[Mailing List, Third Party Advisory] http://www.openwall.com/lists/oss-security/2022/09/24/2

[Vendor Advisory] https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/log/drivers/media/dvb-core/dmxdev.c

[Mailing List] https://lists.debian.org/debian-lts-announce/2023/03/msg00000.html

[Third Party Advisory] https://www.debian.org/security/2023/dsa-5324

[Patch] https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=fd3d91ab1c6ab0628fe642dd570b56302c30a792

[Mailing List] https://lists.debian.org/debian-lts-announce/2023/05/msg00006.html

Scores

CVSS v3 5.5

EPSS 0.0043

EPSS Percentile 62.3%

Attack Vector LOCAL

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Details

CWE

CWE-416

Status published

Products (2)

debian/debian_linux 11.0

linux/linux_kernel < 5.19.10

Published Sep 21, 2022

Tracked Since Feb 18, 2026