PT-2022-4754 · Linux+6 · Linux Kernel+6
Hyunwoo Kim
·
Published
2022-09-09
·
Updated
2023-08-14
·
CVE-2022-40307
CVSS v2.0
9.0
High
| Vector | AV:N/AC:L/Au:S/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
Linux kernel versions through 5.19.8
Description
The issue is related to a use-after-free condition in the Linux kernel, specifically in the drivers/firmware/efi/capsule-loader.c component. This condition arises due to a race condition, which can be exploited by a remote attacker to potentially elevate privileges or cause a denial of service.
Recommendations
For Linux kernel versions through 5.19.8, update to a version that includes the fix for this issue to prevent exploitation.
As a temporary workaround, consider restricting access to the capsule-loader.c component until a patch is available.
Avoid using the affected component in sensitive operations until the issue is resolved.
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Use After Free
Race Condition
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Alt Linux
Astra Linux
Linuxmint
Linux Kernel
Red Os
Suse
Ubuntu