CVE-2022-50677

A use-after-free flaw was found in the IPMI driver in the Linux kernel. In _ipmi_destroy_user(), the intf_free() function frees the interface pointer, but the code subsequently attempts to dereference this freed pointer. This could result in kernel crashes or potentially allow an attacker with local access to escalate privileges.

The bug involves a straightforward use-after-free but occurs in a narrow code path during IPMI interface teardown. Exploiting this for privilege escalation would require precise timing and IPMI hardware access.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, prevent the ipmi_msghandler module from being loaded. See https://access.redhat.com/solutions/41278 for instructions.