PT-2022-5942 · Linux+8 · Linux Kernel+8
Abhishek Shah
·
Published
2022-07-21
·
Updated
2023-08-14
·
CVE-2022-3028
CVSS v3.1
7.0
High
| Vector | AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Linux kernel (affected versions not specified)
Description
A race condition was found in the Linux kernel's IP framework for transforming packets (XFRM subsystem) when multiple calls to
xfrm probe algs occurred simultaneously. This flaw could allow a local attacker to potentially trigger an out-of-bounds write or leak kernel heap memory by performing an out-of-bounds read and copying it into a socket. The vulnerability may also allow an attacker to execute arbitrary code, cause a denial of service, or have other impacts on the system.Recommendations
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Race Condition
Memory Corruption
Out of bounds Read
Improper Locking
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Alt Linux
Almalinux
Astra Linux
Centos
Linuxmint
Linux Kernel
Red Hat
Suse
Ubuntu