CVE-2022-50095

In the Linux kernel, the following vulnerability has been resolved:

posix-cpu-timers: Cleanup CPU timers before freeing them during exec

Commit 55e8c8eb2c7b ("posix-cpu-timers: Store a reference to a pid not a task") started looking up tasks by PID when deleting a CPU timer.

When a non-leader thread calls execve, it will switch PIDs with the leader process. Then, as it calls exit_itimers, posix_cpu_timer_del cannot find the task because the timer still points out to the old PID.

That means that armed timers won't be disarmed, that is, they won't be removed from the timerqueue_list. exit_itimers will still release their memory, and when that list is later processed, it leads to a use-after-free.

Clean up the timers from the de-threaded task before freeing them. This prevents a reported use-after-free.

This vulnerability is rated as Moderate severity for Red Hat Enterprise Linux because it requires local access and specific multi-threaded process execution conditions to trigger. An attacker must execute a binary where a non-leader thread replaces its process image while armed CPU timers remain active. Although triggering the resulting kernel use-after-free condition could lead to a system crash or privilege escalation, the flaw cannot be exploited remotely or over network interfaces.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.