SB20250226269 - Use-after-free in Linux kernel ethernet sfc driver
Published: February 26, 2025 Updated: May 11, 2025
Security Bulletin ID
SB20250226269
Severity
Low
Patch available
YES
Number of vulnerabilities
1
Exploitation vector
Local access
Highest impact
Code execution
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 1 security vulnerability.
1) Use-after-free (CVE-ID: CVE-2022-49625)
The vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to a use-after-free error within the efx_ef10_try_update_nic_stats_vf() function in drivers/net/ethernet/sfc/ef10.c. A local user can escalate privileges on the system.
Remediation
Install update from vendor's website.
References
- https://git.kernel.org/stable/c/16662524ec5da801fb78a1afcaf6e782f1cf103a
- https://git.kernel.org/stable/c/68e5f32f0de9594629ff9e599294d9801c6187de
- https://git.kernel.org/stable/c/82bcb730f856086f033e6c04082eb4503d4c2fa4
- https://git.kernel.org/stable/c/ada74c5539eba06cf8b47d068f92e0b3963a9a6e
- https://git.kernel.org/stable/c/b82e4ad58a7fb72456503958a93060f87896e629
- https://git.kernel.org/stable/c/b9072305270579a9d6afc9b926166231e5b1a7c8
- https://git.kernel.org/stable/c/d9840212a9c00507347c703f4fdeda16400407e0
- https://git.kernel.org/stable/c/da346adcf5573fd8663cabfdfe8371009629a906
- https://mirrors.edge.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.4.207