PT-2022-5927 · Linux+3 · Linux Kernel+3

Hyunwoo Kim · Published 2022-10-29 · Updated 2026-05-26 · CVE-2022-44034

Positive Technologies (AI Summary)

CVSS v3.1

6.4

Medium

Base vector

AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel versions through 6.0.6

Description The issue is caused by synchronization errors when using a shared resource in the Linux kernel's drivers/char/pcmcia/scr24x cs.c component. This can lead to a race condition and resultant use-after-free if a physically proximate attacker removes a PCMCIA device while calling open(), specifically between the scr24x open() and scr24x remove() functions.

Recommendations For Linux kernel versions through 6.0.6, consider disabling the use of PCMCIA devices or restricting access to the scr24x open() and scr24x remove() functions until a patch is available. As a temporary workaround, avoid removing PCMCIA devices while the open() function is being called to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

DoS

Race Condition

Weakness Enumeration

CWE-362

Related Identifiers

ALT-PU-2022-2993

ALT-PU-2022-3060

ALT-PU-2022-3364

ALT-PU-2022-3371

ALT-PU-2023-1684

ALT-PU-2023-1741

ALT-PU-2023-1814

ALT-PU-2023-4894

AZL-11382

BDU:2022-07347

CVE-2022-44034

ECHO-F5FB-51CB-211B

OPENSUSE-SU-2024:12470-1

OPENSUSE-SU-2024:13704-1

Affected Products

Alt Linux

Debian

Linux Kernel

Red Os

References · 217

• https://osv.dev/vulnerability/openSUSE-SU-2024:13704-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2022-44034 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-44034 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:12470-1 · Vendor Advisory
• https://osv.dev/vulnerability/ROOT-OS-UBUNTU-2204-CVE-2022-44034 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-07347 · Security Note
• http://repo.red-soft.ru/redos/7.3c/x86_64/updates · Vendor Advisory
• https://osv.dev/vulnerability/ROOT-OS-DEBIAN-12-CVE-2022-44034 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-44034 · Security Note
• https://osv.dev/vulnerability/CVE-2022-44034 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-44034 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-44034 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2022-44034 · Vendor Advisory
• https://osv.dev/vulnerability/ROOT-OS-UBUNTU-2404-CVE-2022-44034 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-11382 · Vendor Advisory