Back
CVE-2022-49258
crypto: ccree - Fix use after free in cc_cipher_exit()
High7.8EPSS 0.27%
- Published
- Updated
- Reserved
- Assigned by
- Linux
Description
In the Linux kernel, the following vulnerability has been resolved: crypto: ccree - Fix use after free in cc_cipher_exit() kfree_sensitive(ctx_p->user.key) will free the ctx_p->user.key. But ctx_p->user.key is still used in the next line, which will lead to a use after free. We can call kfree_sensitive() after dev_dbg() to avoid the uaf.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| CISA-ADPADP (enrichment) | 3.1 | High7.8 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| NVDNVD · Analyzed | 3.1 | High7.8 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
- EPSS (exploitation in 30 days)
- 0.27% · top 81% of all CVEs (6 Nov 2026)
- CISA SSVC
- Exploitation: none · Automatable: no · Technical impact: total
Loading the EPSS history…
The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.8.
Weakness
Affected products
- affected 63ee04c8b491ee148489347e7da9fbfd982ca2bb – < c93017c8d5ebf55a4e453ac7c84cc84cf92ab570
- affected 63ee04c8b491ee148489347e7da9fbfd982ca2bb – < 335bf1fc74f775a8255257aa3e33763f2257b676
- affected 63ee04c8b491ee148489347e7da9fbfd982ca2bb – < 25c358efee5153dfd240d4e0d3169d5bebe9cacd
- affected 63ee04c8b491ee148489347e7da9fbfd982ca2bb – < cffb5382bd8d3cf21b874ab5b84bf7618932286b
- affected 63ee04c8b491ee148489347e7da9fbfd982ca2bb – < 3d950c34074ed74d2713c3856ba01264523289e6
- affected 4.17
- unaffected < 4.17
- unaffected 5.10.110 – ≤ 5.10.*
- unaffected 5.15.33 – ≤ 5.15.*
- unaffected 5.16.19 – ≤ 5.16.*
- unaffected 5.17.2 – ≤ 5.17.*
- unaffected 5.18 – ≤ *
References (5)
- https://git.kernel.org/stable/c/c93017c8d5ebf55a4e453ac7c84cc84cf92ab570 (opens in a new tab)
- https://git.kernel.org/stable/c/335bf1fc74f775a8255257aa3e33763f2257b676 (opens in a new tab)
- https://git.kernel.org/stable/c/25c358efee5153dfd240d4e0d3169d5bebe9cacd (opens in a new tab)
- https://git.kernel.org/stable/c/cffb5382bd8d3cf21b874ab5b84bf7618932286b (opens in a new tab)
- https://git.kernel.org/stable/c/3d950c34074ed74d2713c3856ba01264523289e6 (opens in a new tab)
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://trackcve.app/cve/CVE-2022-49258)Record last updated .