CVE-2022-34495: 
Linux Kernel vulnerability analysis and mitigation

CVE-2022-34495 is a double free vulnerability discovered in the Linux kernel's rpmsg_probe function located in drivers/rpmsg/virtio_rpmsg_bus.c, affecting versions before 5.18.4. The vulnerability was disclosed on June 26, 2022 (NVD, CVE).

The vulnerability is classified as a double free condition (CWE-415) in the rpmsg_probe function. The issue occurs when rpmsg_ns_register_device() fails, causing the vch pointer to be freed twice - once in the error handling path and again in virtio_rpmsg_release_device(). The CVSS v3.1 base score is 5.5 (Medium) with vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H (NVD).

The double free vulnerability could potentially lead to a denial of service condition through system crashes. The vulnerability requires local access and low privileges to exploit (Ubuntu).

The vulnerability requires local access with low privileges to exploit. There are no known public exploits targeting this vulnerability at the time of assessment (NVD).

The vulnerability was fixed in Linux kernel version 5.18.4. The fix involves modifying the error handling path in rpmsg_probe() to avoid the double free by changing the error path from free_vch to free_ctrldev, as vch will be freed in virtio_rpmsg_release_device() (Linux Commit).