Exploiting CVE-2022-42703 - Bringing back the stack attack
Summary: Google Project Zero's Seth Jenkins published an exploit for CVE-2022-42703, a use-after-free on struct anon_vma in the Linux kernel's memory management subsystem that Jann Horn found and that was fixed on 5 September 2022. The exploit reclaims the freed anon_vma with sprayed pipe buffers, turns the bug into a constrained arbitrary write via down_read_trylock(), and targets the non-randomized cpu_entry_area exception stacks to corrupt a saved rcx length value during copy_to_user and copy_from_user calls.
What's compelling: The write primitive is narrow enough that the author needed a prefetch side channel to defeat KASLR and the proposed cpu_entry_area randomization, and he notes that randomizing the CEA is effective against remote attackers but insufficient against a local one - so the mitigation Project Zero suggested does not close the local attack path.
Read the original at Google Project Zero ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2022-42703
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026