CVE-2022-49258: 
Linux Kernel vulnerability analysis and mitigation

CVE-2022-49258 is a use-after-free vulnerability discovered in the Linux kernel's crypto subsystem, specifically in the ccree (ARM CryptoCell REE) driver. The vulnerability was identified in the cc_cipher_exit() function where ctx_p->user.key is freed but then accessed in the following line, leading to a potential use-after-free condition (NVD).

The vulnerability exists in the cc_cipher_exit() function of the Linux kernel's crypto ccree driver. The issue occurs when kfree_sensitive(ctx_p->user.key) frees the key buffer, but the freed pointer is subsequently used in a dev_dbg() call. The vulnerability has been assigned a CVSS v3.1 base score of 7.8 (HIGH) with vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. The weakness is classified as CWE-416 (Use After Free) (NVD).

The vulnerability could potentially lead to memory corruption due to accessing freed memory. This could result in system crashes, information leaks, or potential privilege escalation in the Linux kernel. The high CVSS score indicates that successful exploitation could have significant impacts on system confidentiality, integrity, and availability (NVD).

The vulnerability requires local access with low privileges to exploit. No active exploits have been reported in the wild. The attack complexity is considered low, requiring no user interaction, but does need local access to the system (NVD).

The vulnerability has been fixed by reordering the operations in cc_cipher_exit(), moving the kfree_sensitive() call after the dev_dbg() call. The fix was implemented in the Linux kernel through commit 3d950c34074ed74d2713c3856ba01264523289e6 (Kernel Commit). Users should update their Linux kernel to a version containing this fix.