CVE-2022-48754: phylib: fix potential use-after-free
In the Linux kernel, the following vulnerability has been resolved:
phylib: fix potential use-after-free
Commit bafbdd527d56 ("phylib: Add device reset GPIO support") added call to phydevicereset(phydev) after the putdevice() call in phydetach().
The comment before the putdevice() call says that the phydev might go away with putdevice().
Fix potential use-after-free by calling phydevicereset() before putdevice().
Other sources
In the Linux kernel, the following vulnerability has been resolved:
phylib: fix potential use-after-free
The Linux kernel CVE team has assigned CVE-2022-48754 to this issue.
Upstream advisory: https://lore.kernel.org/linux-cve-announce/2024062006-CVE-2022-48754-4012@gregkh/T
— Red Hat
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2022-48754?
CVE-2022-48754 is rated as a medium-severity vulnerability affecting the Linux kernel.
How do I fix CVE-2022-48754?
To fix CVE-2022-48754, update the kernel to one of the following versions: 4.19.228, 5.4.176, 5.10.96, 5.15.19, 5.16.5, or 5.17.
What systems are affected by CVE-2022-48754?
CVE-2022-48754 affects multiple versions of the Linux kernel found in various Linux distributions.
Is CVE-2022-48754 a critical vulnerability?
CVE-2022-48754 is not classified as critical; it has a medium severity level.
What types of attacks can exploit CVE-2022-48754?
CVE-2022-48754 could potentially be exploited for a use-after-free attack leading to privilege escalation.