IM
IronMonkey Threat Research

CVE-2022-2905 MEDIUM

Published: 2022-09-09 | Last Modified: 2024-11-21 | Status: Modified

Description

An out-of-bounds memory read flaw was found in the Linux kernel's BPF subsystem in how a user calls the bpf_tail_call function with a key larger than the max_entries of the map. This flaw allows a local user to gain unauthorized access to data.

Additional Descriptions (1)

Se ha encontrado un fallo de lectura de memoria fuera de límites en el subsistema BPF del kernel de Linux en la forma en que un usuario llama a la función bpf_tail_call con una clave mayor que el max_entries del mapa. Este fallo permite a un usuario local conseguir acceso no autorizado a los datos

CVSS Metrics

Base Score: 5.5 (MEDIUM)

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Attack VectorLOCAL
Attack ComplexityLOW
Privileges RequiredLOW
User InteractionNONE
ScopeUNCHANGED
Confidentiality ImpactHIGH
Integrity ImpactNONE
Availability ImpactNONE

Source: [email protected]

Type: Primary

Exploitability Score: 1.8

Impact Score: 3.6

Weaknesses

Source Type Description
[email protected] Secondary
en CWE-125
[email protected] Secondary
en CWE-125

Affected Products

Vendor Product Version Update Type
linux linux_kernel * <built-in method update of dict object at 0x7fd369a32340> Operating System
linux linux_kernel 6.0 <built-in method update of dict object at 0x7fd36ab5ec00> Operating System
linux linux_kernel 6.0 <built-in method update of dict object at 0x7fd36afa4e40> Operating System
linux linux_kernel 6.0 <built-in method update of dict object at 0x7fd385dd0b80> Operating System
redhat enterprise_linux 8.0 <built-in method update of dict object at 0x7fd369a33780> Operating System
debian debian_linux 10.0 <built-in method update of dict object at 0x7fd369a328c0> Operating System

Affected Configurations

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Yes cpe:2.3:o:linux:linux_kernel:6.0:rc1:*:*:*:*:*:*
Yes cpe:2.3:o:linux:linux_kernel:6.0:rc2:*:*:*:*:*:*
Yes cpe:2.3:o:linux:linux_kernel:6.0:rc3:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*

References