PT-2022-6494 · Linux+5 · Linux Kernel+5

Published 2022-09-30 · Updated 2025-03-03 · CVE-2022-48423

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.1.3

Description The issue is related to the lack of validation of resident attribute names in the fs/ntfs3/record.c module of the Linux kernel. This can lead to an out-of-bounds write. The vulnerability may allow an attacker to impact the confidentiality, integrity, and availability of protected information.

Recommendations For Linux kernel versions prior to 6.1.3, update to version 6.1.3 or later to resolve the issue. As a temporary workaround, consider restricting access to the fs/ntfs3/record.c module until a patch is available.

Fix

Memory Corruption

Weakness Enumeration

CWE-787

CWE-590

Related Identifiers

ALT-PU-2023-1023

ALT-PU-2023-1064

ALT-PU-2023-1684

ALT-PU-2023-1741

ALT-PU-2023-1814

ALT-PU-2023-4894

ALT-PU-2024-4263

ALT-PU-2024-4843

AZL-25694

BDU:2023-01745

CVE-2022-48423

OESA-2023-1188

OESA-2023-1209

USN-5982-1

USN-5987-1

USN-6004-1

USN-6079-1

USN-6091-1

USN-6096-1

Affected Products

Alt Linux

Astra Linux

Linuxmint

Linux Kernel

Red Os

Ubuntu

References · 90

• https://ubuntu.com/security/CVE-2023-0045 · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-1078 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-6096-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-48423 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2023-1209 · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-21102 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-6091-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-41218 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se17-bulletin-2023-0426SE17 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-48424 · Security Note
• https://osv.dev/vulnerability/OESA-2023-1188 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-28327 · Security Note
• https://ubuntu.com/security/CVE-2022-2196 · Vendor Advisory
• https://osv.dev/vulnerability/USN-5987-1 · Vendor Advisory
• https://osv.dev/vulnerability/USN-6004-1 · Vendor Advisory