SB20250226295 - Use-after-free in Linux kernel intel ice driver

Description

This security bulletin contains information about 1 security vulnerability.

1) Use-after-free (CVE-ID: CVE-2022-49063)

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the ice_vsi_req_irq_msix(), ice_setup_pf_sw() and ice_suspend() functions in drivers/net/ethernet/intel/ice/ice_main.c, within the ice_vsi_free_irq() function in drivers/net/ethernet/intel/ice/ice_lib.c, within the ice_free_cpu_rx_rmap(), ice_set_cpu_rx_rmap(), ice_remove_arfs() and ice_rebuild_arfs() functions in drivers/net/ethernet/intel/ice/ice_arfs.c. A local user can escalate privileges on the system.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/d08d2fb6d99d82da1c63aba5c0d1c6f237e150f3
• https://git.kernel.org/stable/c/d7442f512b71fc63a99c8a801422dde4fbbf9f93
• https://mirrors.edge.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.17.4
• https://mirrors.edge.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.18