PT-2022-7184 · Linux+1 · Linux Kernel+1

Marian Rehak · Published 2022-06-02 · Updated 2023-02-14 · CVE-2022-1976

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A flaw was found in the Linux kernel's implementation of IO-URING, allowing an attacker with local executable permission to create a string of requests that can cause a use-after-free flaw within the kernel. This issue leads to memory corruption and possible privilege escalation. The flaw is related to the use of memory after it has been freed.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Use After Free

Weakness Enumeration

CWE-416

Related Identifiers

ALT-PU-2022-2131

ALT-PU-2022-2148

AZL-10821

BDU:2023-08894

CVE-2022-1976

Affected Products

Alt Linux

Linux Kernel

References · 17

• https://nvd.nist.gov/vuln/detail/CVE-2022-1976 · Security Note
• https://bugzilla.redhat.com/show_bug.cgi?id=2092549 · Patch
• https://osv.dev/vulnerability/AZL-10821 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2022-1976 · Security Note
• https://ubuntu.com/security/CVE-2022-1976 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2022-1976 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-1976 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-08894 · Security Note
• https://osv.dev/vulnerability/CVE-2022-1976 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-1976 · Vendor Advisory
• https://t.me/cibsecurity/49123 · Telegram Post
• https://xn--80ahaefyxhn.xn--j1afgaq.xn--p1ai/bin/view/%D0%9E%D0%A1%D0%BD%D0%BE%D0%B2%D0%B0/%D0%9E%D0%B1%D0%BD%D0%BE%D0%B2%D0%BB%D0%B5%D0%BD%D0%B8%D1%8F/2.10 · Note
• https://git.kernel.org/linus/9cae36a094e7e9d6e5fe8b6dcd4642138b3eb0c7 · Note
• https://security.netapp.com/advisory/ntap-20230214-0005 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-1976 · Note