IM
IronMonkey Threat Research

CVE-2022-3028 HIGH

Published: 2022-08-31 | Last Modified: 2024-11-21 | Status: Modified

Description

A race condition was found in the Linux kernel's IP framework for transforming packets (XFRM subsystem) when multiple calls to xfrm_probe_algs occurred simultaneously. This flaw could allow a local attacker to potentially trigger an out-of-bounds write or leak kernel heap memory by performing an out-of-bounds read and copying it into a socket.

Additional Descriptions (1)

Se ha encontrado una condición de carrera en el marco IP del kernel de Linux para la transformación de paquetes (subsistema XFRM) cuando son producidas simultáneamente varias llamadas a xfrm_probe_algs. Este fallo podría permitir a un atacante local desencadenar potencialmente una escritura fuera de límites o una pérdida de memoria de la pila del kernel al llevar a cabo una lectura fuera de límites y copiarla en un socket

CVSS Metrics

Base Score: 7.0 (HIGH)

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack VectorLOCAL
Attack ComplexityHIGH
Privileges RequiredLOW
User InteractionNONE
ScopeUNCHANGED
Confidentiality ImpactHIGH
Integrity ImpactHIGH
Availability ImpactHIGH

Source: [email protected]

Type: Primary

Exploitability Score: 1.0

Impact Score: 5.9

Weaknesses

Source Type Description
[email protected] Secondary
en CWE-667
[email protected] Primary
en CWE-362
en CWE-787

Affected Products

Vendor Product Version Update Type
linux linux_kernel * <built-in method update of dict object at 0x7fd370349700> Operating System
linux linux_kernel * <built-in method update of dict object at 0x7fd34927cf80> Operating System
linux linux_kernel * <built-in method update of dict object at 0x7fd384947c40> Operating System
linux linux_kernel * <built-in method update of dict object at 0x7fd340bfd2c0> Operating System
linux linux_kernel * <built-in method update of dict object at 0x7fd341755140> Operating System
linux linux_kernel * <built-in method update of dict object at 0x7fd3417541c0> Operating System
linux linux_kernel * <built-in method update of dict object at 0x7fd368634780> Operating System
linux linux_kernel 6.0 <built-in method update of dict object at 0x7fd2a10da200> Operating System
linux linux_kernel 6.0 <built-in method update of dict object at 0x7fd39c4f3a40> Operating System
fedoraproject fedora 35 <built-in method update of dict object at 0x7fd37034b040> Operating System
fedoraproject fedora 36 <built-in method update of dict object at 0x7fd369b57340> Operating System
fedoraproject fedora 37 <built-in method update of dict object at 0x7fd34927fc80> Operating System
debian debian_linux 10.0 <built-in method update of dict object at 0x7fd340bfc300> Operating System

Affected Configurations

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Yes cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Yes cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Yes cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Yes cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Yes cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Yes cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Yes cpe:2.3:o:linux:linux_kernel:6.0:rc1:*:*:*:*:*:*
Yes cpe:2.3:o:linux:linux_kernel:6.0:rc2:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*
Yes cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:*
Yes cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*

References