CVE-2022-23090 - Vulnerability Details

Vendors	Products
Freebsd	Freebsd

Link	Providers
https://security.freebsd.org/advisories/FreeBSD-SA-22:10.aio.asc
https://security.netapp.com/advisory/ntap-20240415-0007/

Type	Values Removed	Values Added
CPEs		cpe:2.3:o:freebsd:freebsd:12.3:beta1:::::: cpe:2.3:o:freebsd:freebsd:12.3:p1:::::: cpe:2.3:o:freebsd:freebsd:12.3:p2:::::: cpe:2.3:o:freebsd:freebsd:12.3:p3:::::: cpe:2.3:o:freebsd:freebsd:12.3:p4:::::: cpe:2.3:o:freebsd:freebsd:12.3:p5:::::: cpe:2.3:o:freebsd:freebsd:13.0:beta1:::::: cpe:2.3:o:freebsd:freebsd:13.0:beta2:::::: cpe:2.3:o:freebsd:freebsd:13.0:beta3-p1:::::: cpe:2.3:o:freebsd:freebsd:13.0:beta3:::::: cpe:2.3:o:freebsd:freebsd:13.0:beta4:::::: cpe:2.3:o:freebsd:freebsd:13.0:p10:::::: cpe:2.3:o:freebsd:freebsd:13.0:p11:::::: cpe:2.3:o:freebsd:freebsd:13.0:p1:::::: cpe:2.3:o:freebsd:freebsd:13.0:p2:::::: cpe:2.3:o:freebsd:freebsd:13.0:p3:::::: cpe:2.3:o:freebsd:freebsd:13.0:p4:::::: cpe:2.3:o:freebsd:freebsd:13.0:p5:::::: cpe:2.3:o:freebsd:freebsd:13.0:p6:::::: cpe:2.3:o:freebsd:freebsd:13.0:p7:::::: cpe:2.3:o:freebsd:freebsd:13.0:p8:::::: cpe:2.3:o:freebsd:freebsd:13.0:p9:::::: cpe:2.3:o:freebsd:freebsd:13.0:rc1:::::: cpe:2.3:o:freebsd:freebsd:13.0:rc2:::::: cpe:2.3:o:freebsd:freebsd:13.0:rc3:::::: cpe:2.3:o:freebsd:freebsd:13.0:rc4:::::: cpe:2.3:o:freebsd:freebsd:13.0:rc5-p1:::::: cpe:2.3:o:freebsd:freebsd:13.0:rc5::::::

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 7.7, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N'}`

Type	Values Removed	Values Added
First Time appeared		Freebsd Freebsd freebsd
CPEs		cpe:2.3:o:freebsd:freebsd::::::::
Vendors & Products		Freebsd Freebsd freebsd
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Type	Values Removed	Values Added
Weaknesses		CWE-416

Show plain JSON

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2022-23090", "assignerOrgId": "63664ac6-956c-4cba-a5d0-f46076e16109", "state": "PUBLISHED", "assignerShortName": "freebsd", "dateReserved": "2022-01-10T22:07:46.041Z", "datePublished": "2024-02-15T05:09:27.389Z", "dateUpdated": "2025-03-28T23:57:52.965Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unknown", "modules": ["kernel"], "product": "FreeBSD", "vendor": "FreeBSD", "versions": [{"lessThan": "p1", "status": "affected", "version": "13.1-RELEASE", "versionType": "release"}, {"lessThan": "p12", "status": "affected", "version": "13.0-RELEASE", "versionType": "release"}, {"lessThan": "p6", "status": "affected", "version": "12.3-RELEASE", "versionType": "release"}]}], "credits": [{"lang": "en", "type": "finder", "user": "00000000-0000-4000-9000-000000000000", "value": "Chris J-D <chris@accessvector.net>"}], "datePublic": "2022-08-09T23:00:00.000Z", "descriptions": [{"lang": "en", "value": "The aio_aqueue function, used by the lio_listio system call, fails to release a reference to a credential in an error case.\n\nAn attacker may cause the reference count to overflow, leading to a use after free (UAF)."}], "providerMetadata": {"orgId": "63664ac6-956c-4cba-a5d0-f46076e16109", "shortName": "freebsd", "dateUpdated": "2024-04-15T15:06:15.094Z"}, "references": [{"tags": ["vendor-advisory"], "url": "https://security.freebsd.org/advisories/FreeBSD-SA-22:10.aio.asc"}, {"url": "https://security.netapp.com/advisory/ntap-20240415-0007/"}], "source": {"discovery": "UNKNOWN"}, "title": "AIO credential reference count leak", "x_generator": {"engine": "Vulnogram 0.1.0-dev"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T03:28:43.512Z"}, "title": "CVE Program Container", "references": [{"tags": ["vendor-advisory", "x_transferred"], "url": "https://security.freebsd.org/advisories/FreeBSD-SA-22:10.aio.asc"}, {"url": "https://security.netapp.com/advisory/ntap-20240415-0007/", "tags": ["x_transferred"]}]}, {"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-416", "lang": "en", "description": "CWE-416 Use After Free"}]}], "affected": [{"vendor": "freebsd", "product": "freebsd", "cpes": ["cpe:2.3:o:freebsd:freebsd:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "13.0", "status": "affected", "lessThan": "13.0_p12", "versionType": "custom"}, {"version": "13.1", "status": "affected", "lessThan": "13.1_p1", "versionType": "custom"}]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.7, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2024-02-21T17:10:00.368345Z", "id": "CVE-2022-23090", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-03-28T23:57:52.965Z"}}]}}

{

dataType : CVE_RECORD (string)

dataVersion : 5.1 (string)

cveMetadata : { »

cveId : CVE-2022-23090 (string)

assignerOrgId : 63664ac6-956c-4cba-a5d0-f46076e16109 (string)

state : PUBLISHED (string)

assignerShortName : freebsd (string)

dateReserved : 2022-01-10T22:07:46.041Z (string)

datePublished : 2024-02-15T05:09:27.389Z (string)

dateUpdated : 2025-03-28T23:57:52.965Z (string)

}

containers : { »

cna : { »

affected : [ »

0 : { »

defaultStatus : unknown (string)

modules : [ »

0 : kernel (string)

]

product : FreeBSD (string)

vendor : FreeBSD (string)

versions : [ »

0 : { »

lessThan : p1 (string)

status : affected (string)

version : 13.1-RELEASE (string)

versionType : release (string)

}

1 : { »

lessThan : p12 (string)

status : affected (string)

version : 13.0-RELEASE (string)

versionType : release (string)

}

2 : { »

lessThan : p6 (string)

status : affected (string)

version : 12.3-RELEASE (string)

versionType : release (string)

}

]

}

]

credits : [ »

0 : { »

lang : en (string)

type : finder (string)

user : 00000000-0000-4000-9000-000000000000 (string)

value : Chris J-D <chris@accessvector.net> (string)

}

]

datePublic : 2022-08-09T23:00:00.000Z (string)

descriptions : [ »

0 : { »

lang : en (string)

value : The aio_aqueue function, used by the lio_listio system call, fails to release a reference to a credential in an error case. An attacker may cause the reference count to overflow, leading to a use after free (UAF). (string)

}

]

providerMetadata : { »

orgId : 63664ac6-956c-4cba-a5d0-f46076e16109 (string)

shortName : freebsd (string)

dateUpdated : 2024-04-15T15:06:15.094Z (string)

}

references : [ »

0 : { »

tags : [ »

0 : vendor-advisory (string)

]

url : https://security.freebsd.org/advisories/FreeBSD-SA-22:10.aio.asc (string)

}

1 : { »

url : https://security.netapp.com/advisory/ntap-20240415-0007/ (string)

}

]

source : { »

discovery : UNKNOWN (string)

}

title : AIO credential reference count leak (string)

x_generator : { »

engine : Vulnogram 0.1.0-dev (string)

}

adp : [ »

0 : { »

providerMetadata : { »

orgId : af854a3a-2127-422b-91ae-364da2661108 (string)

shortName : CVE (string)

dateUpdated : 2024-08-03T03:28:43.512Z (string)

}

title : CVE Program Container (string)

references : [ »

0 : { »

tags : [ »

0 : vendor-advisory (string)

1 : x_transferred (string)

]

url : https://security.freebsd.org/advisories/FreeBSD-SA-22:10.aio.asc (string)

}

1 : { »

url : https://security.netapp.com/advisory/ntap-20240415-0007/ (string)

tags : [ »

0 : x_transferred (string)

]

}

]

}

1 : { »

problemTypes : [ »

0 : { »

descriptions : [ »

0 : { »

type : CWE (string)

cweId : CWE-416 (string)

lang : en (string)

description : CWE-416 Use After Free (string)

}

]

}

]

affected : [ »

0 : { »

vendor : freebsd (string)

product : freebsd (string)

cpes : [ »

0 : cpe:2.3:o:freebsd:freebsd:*:*:*:*:*:*:*:* (string)

]

defaultStatus : unknown (string)

versions : [ »

0 : { »

version : 13.0 (string)

status : affected (string)

lessThan : 13.0_p12 (string)

versionType : custom (string)

}

1 : { »

version : 13.1 (string)

status : affected (string)

lessThan : 13.1_p1 (string)

versionType : custom (string)

}

]

}

]

metrics : [ »

0 : { »

cvssV3_1 : { »

scope : UNCHANGED (string)

version : 3.1 (string)

baseScore : 7.7 (number)

attackVector : LOCAL (string)

baseSeverity : HIGH (string)

vectorString : CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N (string)

integrityImpact : HIGH (string)

userInteraction : NONE (string)

attackComplexity : LOW (string)

availabilityImpact : NONE (string)

privilegesRequired : NONE (string)

confidentialityImpact : HIGH (string)

}

1 : { »

other : { »

type : ssvc (string)

content : { »

timestamp : 2024-02-21T17:10:00.368345Z (string)

id : CVE-2022-23090 (string)

options : [ »

0 : { »

Exploitation : none (string)

}

1 : { »

Automatable : no (string)

}

2 : { »

Technical Impact : total (string)

}

]

role : CISA Coordinator (string)

version : 2.0.3 (string)

}

]

title : CISA ADP Vulnrichment (string)

providerMetadata : { »

orgId : 134c704f-9b21-4f2e-91b3-4a467353bcc0 (string)

shortName : CISA-ADP (string)

dateUpdated : 2025-03-28T23:57:52.965Z (string)

}

]

}

Show plain JSON

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://security.freebsd.org/advisories/FreeBSD-SA-22:10.aio.asc", "tags": ["vendor-advisory", "x_transferred"]}, {"url": "https://security.netapp.com/advisory/ntap-20240415-0007/", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T03:28:43.512Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.7, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2022-23090", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2024-02-21T17:10:00.368345Z"}}}], "affected": [{"cpes": ["cpe:2.3:o:freebsd:freebsd:*:*:*:*:*:*:*:*"], "vendor": "freebsd", "product": "freebsd", "versions": [{"status": "affected", "version": "13.0", "lessThan": "13.0_p12", "versionType": "custom"}, {"status": "affected", "version": "13.1", "lessThan": "13.1_p1", "versionType": "custom"}], "defaultStatus": "unknown"}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-416", "description": "CWE-416 Use After Free"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-08-26T17:54:50.263Z"}}], "cna": {"title": "AIO credential reference count leak", "source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "finder", "user": "00000000-0000-4000-9000-000000000000", "value": "Chris J-D <chris@accessvector.net>"}], "affected": [{"vendor": "FreeBSD", "modules": ["kernel"], "product": "FreeBSD", "versions": [{"status": "affected", "version": "13.1-RELEASE", "lessThan": "p1", "versionType": "release"}, {"status": "affected", "version": "13.0-RELEASE", "lessThan": "p12", "versionType": "release"}, {"status": "affected", "version": "12.3-RELEASE", "lessThan": "p6", "versionType": "release"}], "defaultStatus": "unknown"}], "datePublic": "2022-08-09T23:00:00.000Z", "references": [{"url": "https://security.freebsd.org/advisories/FreeBSD-SA-22:10.aio.asc", "tags": ["vendor-advisory"]}, {"url": "https://security.netapp.com/advisory/ntap-20240415-0007/"}], "x_generator": {"engine": "Vulnogram 0.1.0-dev"}, "descriptions": [{"lang": "en", "value": "The aio_aqueue function, used by the lio_listio system call, fails to release a reference to a credential in an error case.\n\nAn attacker may cause the reference count to overflow, leading to a use after free (UAF)."}], "providerMetadata": {"orgId": "63664ac6-956c-4cba-a5d0-f46076e16109", "shortName": "freebsd", "dateUpdated": "2024-04-15T15:06:15.094Z"}}}, "cveMetadata": {"cveId": "CVE-2022-23090", "state": "PUBLISHED", "dateUpdated": "2025-03-28T23:57:52.965Z", "dateReserved": "2022-01-10T22:07:46.041Z", "assignerOrgId": "63664ac6-956c-4cba-a5d0-f46076e16109", "datePublished": "2024-02-15T05:09:27.389Z", "assignerShortName": "freebsd"}, "dataVersion": "5.1"}

{

dataType : CVE_RECORD (string)

containers : { »

adp : [ »

0 : { »

title : CVE Program Container (string)

references : [ »

0 : { »

url : https://security.freebsd.org/advisories/FreeBSD-SA-22:10.aio.asc (string)

tags : [ »

0 : vendor-advisory (string)

1 : x_transferred (string)

]

}

1 : { »

url : https://security.netapp.com/advisory/ntap-20240415-0007/ (string)

tags : [ »

0 : x_transferred (string)

]

}

]

providerMetadata : { »

orgId : af854a3a-2127-422b-91ae-364da2661108 (string)

shortName : CVE (string)

dateUpdated : 2024-08-03T03:28:43.512Z (string)

}

1 : { »

title : CISA ADP Vulnrichment (string)

metrics : [ »

0 : { »

cvssV3_1 : { »

scope : UNCHANGED (string)

version : 3.1 (string)

baseScore : 7.7 (number)

attackVector : LOCAL (string)

baseSeverity : HIGH (string)

vectorString : CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N (string)

integrityImpact : HIGH (string)

userInteraction : NONE (string)

attackComplexity : LOW (string)

availabilityImpact : NONE (string)

privilegesRequired : NONE (string)

confidentialityImpact : HIGH (string)

}

1 : { »

other : { »

type : ssvc (string)

content : { »

id : CVE-2022-23090 (string)

role : CISA Coordinator (string)

options : [ »

0 : { »

Exploitation : none (string)

}

1 : { »

Automatable : no (string)

}

2 : { »

Technical Impact : total (string)

}

]

version : 2.0.3 (string)

timestamp : 2024-02-21T17:10:00.368345Z (string)

}

]

affected : [ »

0 : { »

cpes : [ »

0 : cpe:2.3:o:freebsd:freebsd:*:*:*:*:*:*:*:* (string)

]

vendor : freebsd (string)

product : freebsd (string)

versions : [ »

0 : { »

status : affected (string)

version : 13.0 (string)

lessThan : 13.0_p12 (string)

versionType : custom (string)

}

1 : { »

status : affected (string)

version : 13.1 (string)

lessThan : 13.1_p1 (string)

versionType : custom (string)

}

]

defaultStatus : unknown (string)

}

]

problemTypes : [ »

0 : { »

descriptions : [ »

0 : { »

lang : en (string)

type : CWE (string)

cweId : CWE-416 (string)

description : CWE-416 Use After Free (string)

}

]

}

]

providerMetadata : { »

orgId : 134c704f-9b21-4f2e-91b3-4a467353bcc0 (string)

shortName : CISA-ADP (string)

dateUpdated : 2024-08-26T17:54:50.263Z (string)

}

]

cna : { »

title : AIO credential reference count leak (string)

source : { »

discovery : UNKNOWN (string)

}

credits : [ »

0 : { »

lang : en (string)

type : finder (string)

user : 00000000-0000-4000-9000-000000000000 (string)

value : Chris J-D <chris@accessvector.net> (string)

}

]

affected : [ »

0 : { »

vendor : FreeBSD (string)

modules : [ »

0 : kernel (string)

]

product : FreeBSD (string)

versions : [ »

0 : { »

status : affected (string)

version : 13.1-RELEASE (string)

lessThan : p1 (string)

versionType : release (string)

}

1 : { »

status : affected (string)

version : 13.0-RELEASE (string)

lessThan : p12 (string)

versionType : release (string)

}

2 : { »

status : affected (string)

version : 12.3-RELEASE (string)

lessThan : p6 (string)

versionType : release (string)

}

]

defaultStatus : unknown (string)

}

]

datePublic : 2022-08-09T23:00:00.000Z (string)

references : [ »

0 : { »

url : https://security.freebsd.org/advisories/FreeBSD-SA-22:10.aio.asc (string)

tags : [ »

0 : vendor-advisory (string)

]

}

1 : { »

url : https://security.netapp.com/advisory/ntap-20240415-0007/ (string)

}

]

x_generator : { »

engine : Vulnogram 0.1.0-dev (string)

}

descriptions : [ »

0 : { »

lang : en (string)

value : The aio_aqueue function, used by the lio_listio system call, fails to release a reference to a credential in an error case. An attacker may cause the reference count to overflow, leading to a use after free (UAF). (string)

}

]

providerMetadata : { »

orgId : 63664ac6-956c-4cba-a5d0-f46076e16109 (string)

shortName : freebsd (string)

dateUpdated : 2024-04-15T15:06:15.094Z (string)

}

cveMetadata : { »

cveId : CVE-2022-23090 (string)

state : PUBLISHED (string)

dateUpdated : 2025-03-28T23:57:52.965Z (string)

dateReserved : 2022-01-10T22:07:46.041Z (string)

assignerOrgId : 63664ac6-956c-4cba-a5d0-f46076e16109 (string)

datePublished : 2024-02-15T05:09:27.389Z (string)

assignerShortName : freebsd (string)

}

dataVersion : 5.1 (string)

}

Show plain JSON

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:freebsd:freebsd:12.3:beta1:*:*:*:*:*:*", "matchCriteriaId": "E231B24D-5CA9-4107-A819-57EE116AD644", "vulnerable": true}, {"criteria": "cpe:2.3:o:freebsd:freebsd:12.3:p1:*:*:*:*:*:*", "matchCriteriaId": "3B6DCD8A-331E-419F-9253-C4D35C1DF54B", "vulnerable": true}, {"criteria": "cpe:2.3:o:freebsd:freebsd:12.3:p2:*:*:*:*:*:*", "matchCriteriaId": "4578E06C-16C6-435E-9E51-91CB02602355", "vulnerable": true}, {"criteria": "cpe:2.3:o:freebsd:freebsd:12.3:p3:*:*:*:*:*:*", "matchCriteriaId": "71FA1F6C-7E53-40F8-B9E1-5FD28D5DAADA", "vulnerable": true}, {"criteria": "cpe:2.3:o:freebsd:freebsd:12.3:p4:*:*:*:*:*:*", "matchCriteriaId": "0EC87BCE-17F0-479B-84DC-516C24FBD396", "vulnerable": true}, {"criteria": "cpe:2.3:o:freebsd:freebsd:12.3:p5:*:*:*:*:*:*", "matchCriteriaId": "620C23ED-400C-438C-8427-94437F12EDAF", "vulnerable": true}, {"criteria": "cpe:2.3:o:freebsd:freebsd:13.0:beta1:*:*:*:*:*:*", "matchCriteriaId": "7412DBD8-BB1F-48A8-AAE1-BA5C8D7BDDF7", "vulnerable": true}, {"criteria": "cpe:2.3:o:freebsd:freebsd:13.0:beta2:*:*:*:*:*:*", "matchCriteriaId": "833DFF5B-BC50-424A-ABCF-EC632F421B76", "vulnerable": true}, {"criteria": "cpe:2.3:o:freebsd:freebsd:13.0:beta3:*:*:*:*:*:*", "matchCriteriaId": "9F27016E-4117-4094-BB7A-9C56E38024D9", "vulnerable": true}, {"criteria": "cpe:2.3:o:freebsd:freebsd:13.0:beta3-p1:*:*:*:*:*:*", "matchCriteriaId": "EC7326E3-908D-47A1-B848-3AA7F34B3DD3", "vulnerable": true}, {"criteria": "cpe:2.3:o:freebsd:freebsd:13.0:beta4:*:*:*:*:*:*", "matchCriteriaId": "B149BF69-951D-47B4-996C-9E4773DA75B7", "vulnerable": true}, {"criteria": "cpe:2.3:o:freebsd:freebsd:13.0:p1:*:*:*:*:*:*", "matchCriteriaId": "04A0E266-714C-4753-A652-A51F25582C78", "vulnerable": true}, {"criteria": "cpe:2.3:o:freebsd:freebsd:13.0:p10:*:*:*:*:*:*", "matchCriteriaId": "D133E8E0-4E88-451C-9693-5DE5C3092AD2", "vulnerable": true}, {"criteria": "cpe:2.3:o:freebsd:freebsd:13.0:p11:*:*:*:*:*:*", "matchCriteriaId": "FF1A096F-EC60-4C7D-AE40-D1DDAC9D4E40", "vulnerable": true}, {"criteria": "cpe:2.3:o:freebsd:freebsd:13.0:p2:*:*:*:*:*:*", "matchCriteriaId": "556111A1-C236-4DF6-9438-F9C874451A58", "vulnerable": true}, {"criteria": "cpe:2.3:o:freebsd:freebsd:13.0:p3:*:*:*:*:*:*", "matchCriteriaId": "1673F16B-463A-492C-B66F-48917008F7F5", "vulnerable": true}, {"criteria": "cpe:2.3:o:freebsd:freebsd:13.0:p4:*:*:*:*:*:*", "matchCriteriaId": "E73B211F-2CA9-47A4-B318-F24CC1C7E589", "vulnerable": true}, {"criteria": "cpe:2.3:o:freebsd:freebsd:13.0:p5:*:*:*:*:*:*", "matchCriteriaId": "7C13DDEF-FF5F-4723-9C25-4EA66AE2CEDD", "vulnerable": true}, {"criteria": "cpe:2.3:o:freebsd:freebsd:13.0:p6:*:*:*:*:*:*", "matchCriteriaId": "7A942EA9-0DD3-44BC-B582-C680BA34E88F", "vulnerable": true}, {"criteria": "cpe:2.3:o:freebsd:freebsd:13.0:p7:*:*:*:*:*:*", "matchCriteriaId": "689BC10B-0404-4468-B604-9D96337F9BD1", "vulnerable": true}, {"criteria": "cpe:2.3:o:freebsd:freebsd:13.0:p8:*:*:*:*:*:*", "matchCriteriaId": "38DDAA43-3E9C-479F-8416-E3B9BE23C31B", "vulnerable": true}, {"criteria": "cpe:2.3:o:freebsd:freebsd:13.0:p9:*:*:*:*:*:*", "matchCriteriaId": "AE490480-1EA1-4684-A643-9749E87A8448", "vulnerable": true}, {"criteria": "cpe:2.3:o:freebsd:freebsd:13.0:rc1:*:*:*:*:*:*", "matchCriteriaId": "FC271C93-EB83-4301-B7BA-F3249B71B1EA", "vulnerable": true}, {"criteria": "cpe:2.3:o:freebsd:freebsd:13.0:rc2:*:*:*:*:*:*", "matchCriteriaId": "04329338-AC28-4A74-BE6B-CE8EC6CC37B7", "vulnerable": true}, {"criteria": "cpe:2.3:o:freebsd:freebsd:13.0:rc3:*:*:*:*:*:*", "matchCriteriaId": "ADBA841F-5C83-4759-84B7-B59DA1B12EA8", "vulnerable": true}, {"criteria": "cpe:2.3:o:freebsd:freebsd:13.0:rc4:*:*:*:*:*:*", "matchCriteriaId": "6A8F38B3-A6DA-4178-A2BD-0D4F0267C384", "vulnerable": true}, {"criteria": "cpe:2.3:o:freebsd:freebsd:13.0:rc5:*:*:*:*:*:*", "matchCriteriaId": "9BB028A0-70F6-42DA-9E5A-F7AAF74ED45B", "vulnerable": true}, {"criteria": "cpe:2.3:o:freebsd:freebsd:13.0:rc5-p1:*:*:*:*:*:*", "matchCriteriaId": "00D28E4E-022B-482E-9952-7F7F47C427C2", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The aio_aqueue function, used by the lio_listio system call, fails to release a reference to a credential in an error case.\n\nAn attacker may cause the reference count to overflow, leading to a use after free (UAF)."}, {"lang": "es", "value": "La funci\u00f3n aio_aqueue, utilizada por la llamada al sistema lio_listio, no puede liberar una referencia a una credencial en un caso de error. Un atacante puede provocar que el recuento de referencias se desborde, lo que provocar\u00e1 un use after free (UAF)."}], "id": "CVE-2022-23090", "lastModified": "2025-06-04T21:59:04.990", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 7.7, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 2.5, "impactScore": 5.2, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}, "published": "2024-02-15T06:15:45.103", "references": [{"source": "secteam@freebsd.org", "tags": ["Vendor Advisory"], "url": "https://security.freebsd.org/advisories/FreeBSD-SA-22:10.aio.asc"}, {"source": "secteam@freebsd.org", "tags": ["Third Party Advisory"], "url": "https://security.netapp.com/advisory/ntap-20240415-0007/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://security.freebsd.org/advisories/FreeBSD-SA-22:10.aio.asc"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://security.netapp.com/advisory/ntap-20240415-0007/"}], "sourceIdentifier": "secteam@freebsd.org", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-416"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{

configurations : [ »

0 : { »

nodes : [ »

0 : { »

cpeMatch : [ »

0 : { »

criteria : cpe:2.3:o:freebsd:freebsd:12.3:beta1:*:*:*:*:*:* (string)

matchCriteriaId : E231B24D-5CA9-4107-A819-57EE116AD644 (string)

vulnerable : true (boolean)

}

1 : { »

criteria : cpe:2.3:o:freebsd:freebsd:12.3:p1:*:*:*:*:*:* (string)

matchCriteriaId : 3B6DCD8A-331E-419F-9253-C4D35C1DF54B (string)

vulnerable : true (boolean)

}

2 : { »

criteria : cpe:2.3:o:freebsd:freebsd:12.3:p2:*:*:*:*:*:* (string)

matchCriteriaId : 4578E06C-16C6-435E-9E51-91CB02602355 (string)

vulnerable : true (boolean)

}

3 : { »

criteria : cpe:2.3:o:freebsd:freebsd:12.3:p3:*:*:*:*:*:* (string)

matchCriteriaId : 71FA1F6C-7E53-40F8-B9E1-5FD28D5DAADA (string)

vulnerable : true (boolean)

}

4 : { »

criteria : cpe:2.3:o:freebsd:freebsd:12.3:p4:*:*:*:*:*:* (string)

matchCriteriaId : 0EC87BCE-17F0-479B-84DC-516C24FBD396 (string)

vulnerable : true (boolean)

}

5 : { »

criteria : cpe:2.3:o:freebsd:freebsd:12.3:p5:*:*:*:*:*:* (string)

matchCriteriaId : 620C23ED-400C-438C-8427-94437F12EDAF (string)

vulnerable : true (boolean)

}

6 : { »

criteria : cpe:2.3:o:freebsd:freebsd:13.0:beta1:*:*:*:*:*:* (string)

matchCriteriaId : 7412DBD8-BB1F-48A8-AAE1-BA5C8D7BDDF7 (string)

vulnerable : true (boolean)

}

7 : { »

criteria : cpe:2.3:o:freebsd:freebsd:13.0:beta2:*:*:*:*:*:* (string)

matchCriteriaId : 833DFF5B-BC50-424A-ABCF-EC632F421B76 (string)

vulnerable : true (boolean)

}

8 : { »

criteria : cpe:2.3:o:freebsd:freebsd:13.0:beta3:*:*:*:*:*:* (string)

matchCriteriaId : 9F27016E-4117-4094-BB7A-9C56E38024D9 (string)

vulnerable : true (boolean)

}

9 : { »

criteria : cpe:2.3:o:freebsd:freebsd:13.0:beta3-p1:*:*:*:*:*:* (string)

matchCriteriaId : EC7326E3-908D-47A1-B848-3AA7F34B3DD3 (string)

vulnerable : true (boolean)

}

10 : { »

criteria : cpe:2.3:o:freebsd:freebsd:13.0:beta4:*:*:*:*:*:* (string)

matchCriteriaId : B149BF69-951D-47B4-996C-9E4773DA75B7 (string)

vulnerable : true (boolean)

}

11 : { »

criteria : cpe:2.3:o:freebsd:freebsd:13.0:p1:*:*:*:*:*:* (string)

matchCriteriaId : 04A0E266-714C-4753-A652-A51F25582C78 (string)

vulnerable : true (boolean)

}

12 : { »

criteria : cpe:2.3:o:freebsd:freebsd:13.0:p10:*:*:*:*:*:* (string)

matchCriteriaId : D133E8E0-4E88-451C-9693-5DE5C3092AD2 (string)

vulnerable : true (boolean)

}

13 : { »

criteria : cpe:2.3:o:freebsd:freebsd:13.0:p11:*:*:*:*:*:* (string)

matchCriteriaId : FF1A096F-EC60-4C7D-AE40-D1DDAC9D4E40 (string)

vulnerable : true (boolean)

}

14 : { »

criteria : cpe:2.3:o:freebsd:freebsd:13.0:p2:*:*:*:*:*:* (string)

matchCriteriaId : 556111A1-C236-4DF6-9438-F9C874451A58 (string)

vulnerable : true (boolean)

}

15 : { »

criteria : cpe:2.3:o:freebsd:freebsd:13.0:p3:*:*:*:*:*:* (string)

matchCriteriaId : 1673F16B-463A-492C-B66F-48917008F7F5 (string)

vulnerable : true (boolean)

}

16 : { »

criteria : cpe:2.3:o:freebsd:freebsd:13.0:p4:*:*:*:*:*:* (string)

matchCriteriaId : E73B211F-2CA9-47A4-B318-F24CC1C7E589 (string)

vulnerable : true (boolean)

}

17 : { »

criteria : cpe:2.3:o:freebsd:freebsd:13.0:p5:*:*:*:*:*:* (string)

matchCriteriaId : 7C13DDEF-FF5F-4723-9C25-4EA66AE2CEDD (string)

vulnerable : true (boolean)

}

18 : { »

criteria : cpe:2.3:o:freebsd:freebsd:13.0:p6:*:*:*:*:*:* (string)

matchCriteriaId : 7A942EA9-0DD3-44BC-B582-C680BA34E88F (string)

vulnerable : true (boolean)

}

19 : { »

criteria : cpe:2.3:o:freebsd:freebsd:13.0:p7:*:*:*:*:*:* (string)

matchCriteriaId : 689BC10B-0404-4468-B604-9D96337F9BD1 (string)

vulnerable : true (boolean)

}

20 : { »

criteria : cpe:2.3:o:freebsd:freebsd:13.0:p8:*:*:*:*:*:* (string)

matchCriteriaId : 38DDAA43-3E9C-479F-8416-E3B9BE23C31B (string)

vulnerable : true (boolean)

}

21 : { »

criteria : cpe:2.3:o:freebsd:freebsd:13.0:p9:*:*:*:*:*:* (string)

matchCriteriaId : AE490480-1EA1-4684-A643-9749E87A8448 (string)

vulnerable : true (boolean)

}

22 : { »

criteria : cpe:2.3:o:freebsd:freebsd:13.0:rc1:*:*:*:*:*:* (string)

matchCriteriaId : FC271C93-EB83-4301-B7BA-F3249B71B1EA (string)

vulnerable : true (boolean)

}

23 : { »

criteria : cpe:2.3:o:freebsd:freebsd:13.0:rc2:*:*:*:*:*:* (string)

matchCriteriaId : 04329338-AC28-4A74-BE6B-CE8EC6CC37B7 (string)

vulnerable : true (boolean)

}

24 : { »

criteria : cpe:2.3:o:freebsd:freebsd:13.0:rc3:*:*:*:*:*:* (string)

matchCriteriaId : ADBA841F-5C83-4759-84B7-B59DA1B12EA8 (string)

vulnerable : true (boolean)

}

25 : { »

criteria : cpe:2.3:o:freebsd:freebsd:13.0:rc4:*:*:*:*:*:* (string)

matchCriteriaId : 6A8F38B3-A6DA-4178-A2BD-0D4F0267C384 (string)

vulnerable : true (boolean)

}

26 : { »

criteria : cpe:2.3:o:freebsd:freebsd:13.0:rc5:*:*:*:*:*:* (string)

matchCriteriaId : 9BB028A0-70F6-42DA-9E5A-F7AAF74ED45B (string)

vulnerable : true (boolean)

}

27 : { »

criteria : cpe:2.3:o:freebsd:freebsd:13.0:rc5-p1:*:*:*:*:*:* (string)

matchCriteriaId : 00D28E4E-022B-482E-9952-7F7F47C427C2 (string)

vulnerable : true (boolean)

}

]

negate : false (boolean)

operator : OR (string)

}

]

}

]

cveTags : [ *empty* ]

descriptions : [ »

0 : { »

lang : en (string)

value : The aio_aqueue function, used by the lio_listio system call, fails to release a reference to a credential in an error case. An attacker may cause the reference count to overflow, leading to a use after free (UAF). (string)

}

1 : { »

lang : es (string)

value : La función aio_aqueue, utilizada por la llamada al sistema lio_listio, no puede liberar una referencia a una credencial en un caso de error. Un atacante puede provocar que el recuento de referencias se desborde, lo que provocará un use after free (UAF). (string)

}

]

id : CVE-2022-23090 (string)

lastModified : 2025-06-04T21:59:04.990 (string)

metrics : { »

cvssMetricV31 : [ »

0 : { »

cvssData : { »

attackComplexity : LOW (string)

attackVector : LOCAL (string)

availabilityImpact : NONE (string)

baseScore : 7.7 (number)

baseSeverity : HIGH (string)

confidentialityImpact : HIGH (string)

integrityImpact : HIGH (string)

privilegesRequired : NONE (string)

scope : UNCHANGED (string)

userInteraction : NONE (string)

vectorString : CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N (string)

version : 3.1 (string)

}

exploitabilityScore : 2.5 (number)

impactScore : 5.2 (number)

source : 134c704f-9b21-4f2e-91b3-4a467353bcc0 (string)

type : Secondary (string)

}

]

}

published : 2024-02-15T06:15:45.103 (string)

references : [ »

0 : { »

source : secteam@freebsd.org (string)

tags : [ »

0 : Vendor Advisory (string)

]

url : https://security.freebsd.org/advisories/FreeBSD-SA-22:10.aio.asc (string)

}

1 : { »

source : secteam@freebsd.org (string)

tags : [ »

0 : Third Party Advisory (string)

]

url : https://security.netapp.com/advisory/ntap-20240415-0007/ (string)

}

2 : { »

source : af854a3a-2127-422b-91ae-364da2661108 (string)

tags : [ »

0 : Vendor Advisory (string)

]

url : https://security.freebsd.org/advisories/FreeBSD-SA-22:10.aio.asc (string)

}

3 : { »

source : af854a3a-2127-422b-91ae-364da2661108 (string)

tags : [ »

0 : Third Party Advisory (string)

]

url : https://security.netapp.com/advisory/ntap-20240415-0007/ (string)

}

]

sourceIdentifier : secteam@freebsd.org (string)

vulnStatus : Analyzed (string)

weaknesses : [ »

0 : { »

description : [ »

0 : { »

lang : en (string)

value : CWE-416 (string)

}

]

source : 134c704f-9b21-4f2e-91b3-4a467353bcc0 (string)

type : Secondary (string)

}

]

}

Metrics

Attack Vector Local

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact None

User Interaction None

Exploitation none

Automatable no

Technical Impact total

Affected Vendors & Products

Metrics

Attack Vector Local

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact None

User Interaction None

Exploitation none

Automatable no

Technical Impact total

Affected Vendors & Products

JSON object

JSON object

JSON object

JSON object