PT-2022-6254 · Linux+2 · Linux Kernel+2

Gwangun Jung · Published 2022-09-06 · Updated 2023-04-08 · CVE-2022-42432

Positive Technologies (AI Summary)

CVSS v2.0

5.2

Medium

Base vector

AV:L/AC:L/Au:S/C:C/I:N/A:P

Name of the Vulnerable Software and Affected Versions Linux Kernel version 6.0-rc2

Description The issue is related to the use of memory after it has been freed, specifically within the nft osf eval function. This can allow an attacker to disclose sensitive information on affected installations. To exploit this, an attacker must first obtain the ability to execute high-privileged code on the target system. The problem stems from the lack of proper initialization of memory prior to accessing it, which can be leveraged in conjunction with other vulnerabilities to execute arbitrary code in the context of the kernel.

Recommendations For Linux Kernel version 6.0-rc2, consider disabling the nft osf eval function as a temporary workaround until a patch is available. Restrict access to sensitive information and ensure that only authorized personnel have high-privileged access to the system. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Information Disclosure

Use After Free

Weakness Enumeration

CWE-457

CWE-200

CWE-416

Related Identifiers

BDU:2023-00667

CVE-2022-42432

OESA-2022-2045

RHSA-2022:7933

RHSA-2022:8267

RHSA-2022_7933

RHSA-2022_8267

ZDI-22-1457

Affected Products

Astra Linux

Linux Kernel

Red Hat

References · 37

• https://nvd.nist.gov/vuln/detail/CVE-2022-42432 · Security Note
• https://bdu.fstec.ru/vul/2023-00667 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-3629 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-3646 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-22-1457 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-3625 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-3523 · Security Note
• https://cve.org/CVERecord?id=CVE-2022-42432 · Security Note
• https://osv.dev/vulnerability/CVE-2022-42432 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-2978 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-42432 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-42432 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se17-bulletin-2023-1023SE17 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se81-bulletin-20241206SE81 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-43750 · Security Note