Vulnerabilidades do Linux Linux Kernel

CVE-2022-3565 Alta · 7.8 CWE-662 17/10/2022

Linux Kernel Bluetooth l1oip_core.c del_timer use after free

A vulnerability, which was classified as critical, has been found in Linux Kernel. Affected by this issue is the function del_timer of the file drivers/isdn/mISDN/l1oip_core.c of the component Bluetooth. The manipulation leads to use after free. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-211088.

CVE-2022-3564 Alta · 7.1 CWE-362 17/10/2022

Linux Kernel Bluetooth l2cap_core.c l2cap_reassemble_sdu use after free

A vulnerability classified as critical was found in Linux Kernel. Affected by this vulnerability is the function l2cap_reassemble_sdu of the file net/bluetooth/l2cap_core.c of the component Bluetooth. The manipulation leads to use after free. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-211087.

CVE-2022-3545 Alta · 7.8 CWE-119 17/10/2022

Linux Kernel IPsec nfp_cppcore.c area_cache_get use after free

A vulnerability has been found in Linux Kernel and classified as critical. Affected by this vulnerability is the function area_cache_get of the file drivers/net/ethernet/netronome/nfp/nfpcore/nfp_cppcore.c of the component IPsec. The manipulation leads to use after free. It is recommended to apply a patch to fix this issue. The identifier VDB-211045 was assigned to this vulnerability.

CVE-2022-3534 Alta · 8.0 CWE-119 17/10/2022

Linux Kernel libbpf btf_dump.c btf_dump_name_dups use after free

A vulnerability has been found in Linux Kernel up to 5.10.162/5.15.85/6.0.15/6.1.1. The impacted element is the function btf_dump_name_dups of the file tools/lib/bpf/btf_dump.c of the component libbpf. The manipulation leads to use after free. Upgrading to version 5.10.163, 5.15.86, 6.0.16, 6.1.2 and 6.2 is sufficient to resolve this issue. The identifier of the patch is c61650b869e0b6fb0c0a28ed42d928eea969afc8/fbe08093fb2334549859829ef81d42570812597d/8c64a8e76eb85d422af5ec60ccbf26e3ead8c333/a733bf10198eb5bb927890940de8ab457491ed3b/93c660ca40b5d2f7c1b1626e955a8e9fa30e0749. You should upgrade the affected component.

CVE-2022-3524 Média · 5.5 CWE-404 16/10/2022

Linux Kernel IPv6 ipv6_renew_options memory leak

A vulnerability was found in Linux Kernel. It has been declared as problematic. Affected by this vulnerability is the function ipv6_renew_options of the component IPv6 Handler. The manipulation leads to memory leak. The attack can be launched remotely. It is recommended to apply a patch to fix this issue. The identifier VDB-211021 was assigned to this vulnerability.

CVE-2022-3521 Baixa · 2.5 CWE-362 16/10/2022

Linux Kernel kcm kcmsock.c kcm_tx_work race condition

A vulnerability has been found in Linux Kernel and classified as problematic. This vulnerability affects the function kcm_tx_work of the file net/kcm/kcmsock.c of the component kcm. The manipulation leads to race condition. It is recommended to apply a patch to fix this issue. VDB-211018 is the identifier assigned to this vulnerability.

CVE-2022-42722 Média · 5.5 CWE-476 13/10/2022

In the Linux kernel 5.8 through 5.19.14, local attackers able to inject WLAN frames into the...

In the Linux kernel 5.8 through 5.19.x before 5.19.16, local attackers able to inject WLAN frames into the mac80211 stack could cause a NULL pointer dereference denial-of-service attack against the beacon protection of P2P devices.

CVE-2022-42721 Média · 5.5 CWE-835 13/10/2022

A list management bug in BSS handling in the mac80211 stack in the Linux kernel 5.1 through 5.19...

A list management bug in BSS handling in the mac80211 stack in the Linux kernel 5.1 through 5.19.x before 5.19.16 could be used by local attackers (able to inject WLAN frames) to corrupt a linked list and, in turn, potentially execute code.

CVE-2022-42720 Alta · 7.8 CWE-416 13/10/2022

Various refcounting bugs in the multi-BSS handling in the mac80211 stack in the Linux kernel 5.1...

Various refcounting bugs in the multi-BSS handling in the mac80211 stack in the Linux kernel 5.1 through 5.19.x before 5.19.16 could be used by local attackers (able to inject WLAN frames) to trigger use-after-free conditions to potentially execute code.

CVE-2022-41674 Alta · 8.1 CWE-787 13/10/2022

An issue was discovered in the Linux kernel through 5.19.11. Attackers able to inject WLAN frames...

An issue was discovered in the Linux kernel before 5.19.16. Attackers able to inject WLAN frames could cause a buffer overflow in the ieee80211_bss_info_update function in net/mac80211/scan.c.

CVE-2022-42719 Alta · 8.8 CWE-416 13/10/2022

A use-after-free in the mac80211 stack when parsing a multi-BSSID element in the Linux kernel 5.2...

A use-after-free in the mac80211 stack when parsing a multi-BSSID element in the Linux kernel 5.2 through 5.19.x before 5.19.16 could be used by attackers (able to inject WLAN frames) to crash the kernel and potentially execute code.

CVE-2022-42703 Média · 5.5 CWE-416 09/10/2022

mm/rmap.c in the Linux kernel before 5.19.7 has a use-after-free related to leaf anon_vma double...

mm/rmap.c in the Linux kernel before 5.19.7 has a use-after-free related to leaf anon_vma double reuse.

CVE-2022-41849 Média · 4.2 CWE-362 30/09/2022

drivers/video/fbdev/smscufx.c in the Linux kernel through 5.19.12 has a race condition and...

drivers/video/fbdev/smscufx.c in the Linux kernel through 5.19.12 has a race condition and resultant use-after-free if a physically proximate attacker removes a USB device while calling open(), aka a race condition between ufx_ops_open and ufx_usb_disconnect.

CVE-2022-41850 Média · 4.7 CWE-362 30/09/2022

roccat_report_event in drivers/hid/hid-roccat.c in the Linux kernel through 5.19.12 has a race...

roccat_report_event in drivers/hid/hid-roccat.c in the Linux kernel through 5.19.12 has a race condition and resultant use-after-free in certain situations where a report is received while copying a report->value is in progress.

CVE-2022-3303 Média · 4.7 CWE-667 27/09/2022

A race condition flaw was found in the Linux kernel sound subsystem due to improper locking. It...

A race condition flaw was found in the Linux kernel sound subsystem due to improper locking. It could lead to a NULL pointer dereference while handling the SNDCTL_DSP_SYNC ioctl. A privileged local user (root or member of the audio group) could use this flaw to crash the system, resulting in a denial of service condition

CVE-2022-41222 Alta · 7.0 CWE-416 21/09/2022

mm/mremap.c in the Linux kernel before 5.13.3 has a use-after-free via a stale TLB because an...

mm/mremap.c in the Linux kernel before 5.13.3 has a use-after-free via a stale TLB because an rmap lock is not held during a PUD move.

CVE-2022-41218 Média · 5.5 CWE-416 21/09/2022

In drivers/media/dvb-core/dmxdev.c in the Linux kernel through 5.19.10, there is a use-after-free...

In drivers/media/dvb-core/dmxdev.c in the Linux kernel through 5.19.10, there is a use-after-free caused by refcount races, affecting dvb_demux_open and dvb_dmxdev_release.

CVE-2022-40768 Média · 5.5 CWE-908 18/09/2022

drivers/scsi/stex.c in the Linux kernel through 5.19.9 allows local users to obtain sensitive...

drivers/scsi/stex.c in the Linux kernel through 5.19.9 allows local users to obtain sensitive information from kernel memory because stex_queuecommand_lck lacks a memset for the PASSTHRU_CMD case.

CVE-2022-3169 Média · 5.5 CWE-20 09/09/2022

A flaw was found in the Linux kernel. A denial of service flaw may occur if there is a...

A flaw was found in the Linux kernel. A denial of service flaw may occur if there is a consecutive request of the NVME_IOCTL_RESET and the NVME_IOCTL_SUBSYS_RESET through the device file of the driver, resulting in a PCIe link disconnect.

CVE-2022-38096 Média · 5.5 CWE-476 09/09/2022

There is a NULL pointer vulnerability in vmwgfx driver

A NULL pointer dereference vulnerability was found in vmwgfx driver in drivers/gpu/vmxgfx/vmxgfx_execbuf.c in GPU component of Linux kernel with device file '/dev/dri/renderD128 (or Dxxx)'. This flaw allows a local attacker with a user account on the system to gain privilege, causing a denial of service(DoS).

CVE-2022-36280 Média · 5.5 CWE-787 09/09/2022

There is an out-of-bounds write vulnerability in vmwgfx driver

An out-of-bounds(OOB) memory access vulnerability was found in vmwgfx driver in drivers/gpu/vmxgfx/vmxgfx_kms.c in GPU component in the Linux kernel with device file '/dev/dri/renderD128 (or Dxxx)'. This flaw allows a local attacker with a user account on the system to gain privilege, causing a denial of service(DoS).

CVE-2022-2905 Média · 5.5 CWE-125 09/09/2022

Out-of-bounds Read em Linux Linux Kernel

An out-of-bounds memory read flaw was found in the Linux kernel's BPF subsystem in how a user calls the bpf_tail_call function with a key larger than the max_entries of the map. This flaw allows a local user to gain unauthorized access to data.

CVE-2022-40307 Média · 4.7 CWE-362 09/09/2022

An issue was discovered in the Linux kernel through 5.19.8. drivers/firmware/efi/capsule-loader.c...

An issue was discovered in the Linux kernel through 5.19.8. drivers/firmware/efi/capsule-loader.c has a race condition with a resultant use-after-free.

CVE-2022-39190 Média · 5.5 02/09/2022

An issue was discovered in net/netfilter/nf_tables_api.c in the Linux kernel before 5.19.6. A...

An issue was discovered in net/netfilter/nf_tables_api.c in the Linux kernel before 5.19.6. A denial of service can occur upon binding to an already bound chain.

CVE-2022-39188 Média · 4.7 CWE-362 02/09/2022

An issue was discovered in include/asm-generic/tlb.h in the Linux kernel before 5.19. Because of...

An issue was discovered in include/asm-generic/tlb.h in the Linux kernel before 5.19. Because of a race condition (unmap_mapping_range versus munmap), a device driver can free a page while it still has stale TLB entries. This only occurs in situations with VM_PFNMAP VMAs.