Tracker / CVE-2022-50411
CVE-2022-50411
High 7.8
In the Linux kernel, the following vulnerability has been resolved: ACPICA: Fix error code path in acpi_ds_call_control_method() A use-after-free in acpi_ps_parse_aml() after a failing invocaion of acpi_ds_call_control_method() is reported by KASAN [1] and code inspection reveals that next_walk_state pushed to the thread by acpi_ds_create_walk_state() is freed on errors, but it is not popped from the thread beforehand. Thus acpi_ds_get_current_walk_state() called by acpi_ps_parse_aml() subsequently returns it as the new walk state which is incorrect. To address this, make acpi_ds_call_control_method() call acpi_ds_pop_walk_state() to pop next_walk_state from the thread before returning an error.
Affected products and versions
| linux | linux_kernel · … → 4.9.337 |
|---|---|
| linux | linux_kernel · 4.10 → 4.14.303 |
| linux | linux_kernel · 4.15 → 4.19.270 |
| linux | linux_kernel · 4.20 → 5.4.229 |
| linux | linux_kernel · 5.11 → 5.15.86 |
| linux | linux_kernel · 5.16 → 6.0.16 |
| linux | linux_kernel · 5.5 → 5.10.163 |
| linux | linux_kernel · 6.1 → 6.1.2 |
Analysis
This page is not indexable yet.Until it carries original analysis — what it actually exposes, how to check in two minutes whether a system was touched, what to do if it was — the page stays noindex. The database decides that, not the template.