PT-2022-4541 · Linux+9 · Linux Kernel+9

Published 2022-04-03 · Updated 2024-06-15 · CVE-2022-28388

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel versions through 5.17.1

Description The issue is related to a double free error in the usb 8dev start xmit function in the Linux kernel. This error can potentially allow a remote attacker to impact the confidentiality, integrity, and availability of protected information.

Recommendations For Linux kernel versions through 5.17.1, consider disabling the usb 8dev start xmit function as a temporary workaround until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

DoS

Double Free

Weakness Enumeration

CWE-415

Related Identifiers

ALSA-2023:2148

ALSA-2023:2458

ALSA-2023:7077

ALT-PU-2022-1730

ALT-PU-2022-1768

ALT-PU-2022-2152

ALT-PU-2022-2155

ALT-PU-2023-1684

ALT-PU-2023-1741

ALT-PU-2023-1814

ALT-PU-2023-4894

AZL-9293

BDU:2022-05411

CESA-2023_6901

CESA-2023_7077

CVE-2022-28388

DSA-5127-1

DSA-5173-1

MGASA-2022-0154

MGASA-2022-0155

OESA-2022-1666

OPENSUSE-SU-2022_1163-1

OPENSUSE-SU-2022_1183-1

OPENSUSE-SU-2022_1256-1

OPENSUSE-SU-2024:11990-1

OPENSUSE-SU-2024:13704-1

RHSA-2023:2148

RHSA-2023:2458

RHSA-2023:6901

RHSA-2023:7077

RHSA-2023_2148

RHSA-2023_2458

RHSA-2023_6901

RHSA-2023_7077

RHSA-2024:0724

RHSA-2024:1404

SUSE-SU-2022:1163-1

SUSE-SU-2022:1183-1

SUSE-SU-2022:1196-1

SUSE-SU-2022:1197-1

SUSE-SU-2022:1255-1

SUSE-SU-2022:1256-1

SUSE-SU-2022:1257-1

SUSE-SU-2022:1266-1

SUSE-SU-2022:1267-1

SUSE-SU-2022:1402-1

SUSE-SU-2022:1407-1

SUSE-SU-2022:2077-1

SUSE-SU-2022:2082-1

USN-5416-1

USN-5469-1

USN-5493-1

USN-5493-2

USN-5505-1

USN-5513-1

USN-5539-1

USN-5541-1

Affected Products

Alt Linux

Almalinux

Astra Linux

Centos

Linuxmint

Linux Kernel

Red Hat

Red Os

Suse

Ubuntu

References · 731

• https://github.com/torvalds/linux/commit/3d3925ff6433f98992685a9679613a2cc97f3ce2 · Patch
• https://linux.oracle.com/errata/ELSA-2023-2458.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-05411 · Security Note
• https://osv.dev/vulnerability/DSA-5127-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-1679 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XFMPUI3WI4U2F7ONHRW36WDY4ZE7LGGT · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-1205 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-0330 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-1972 · Vendor Advisory
• https://errata.almalinux.org/9/ALSA-2023-2458.html · Vendor Advisory
• https://osv.dev/vulnerability/USN-5541-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2022:1266-1 · Vendor Advisory
• https://osv.dev/vulnerability/USN-5505-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-1652 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-28389 · Security Note