exploitDog

CVE-2022-1734

Опубликовано: 18 мая 2022

Источник: nvd

CVSS3: 7

CVSS2: 4.4

EPSS Низкий

Описание

A flaw in Linux Kernel found in nfcmrvl_nci_unregister_dev() in drivers/nfc/nfcmrvl/main.c can lead to use after free both read or write when non synchronized between cleanup routine and firmware download routine.

Ссылки

http://www.openwall.com/lists/oss-security/2022/06/05/4
Exploit
Mailing List
Patch
Third Party Advisory
http://www.openwall.com/lists/oss-security/2022/06/09/1
Exploit
Mailing List
Patch
Third Party Advisory
https://github.com/torvalds/linux/commit/d270453a0d9ec10bb8a802a142fb1b3601a83098
Patch
Third Party Advisory
https://lists.debian.org/debian-lts-announce/2022/07/msg00000.html
Mailing List
Third Party Advisory
https://security.netapp.com/advisory/ntap-20220707-0007/
Third Party Advisory
https://www.debian.org/security/2022/dsa-5173
Third Party Advisory
http://www.openwall.com/lists/oss-security/2022/06/05/4
Exploit
Mailing List
Patch
Third Party Advisory
http://www.openwall.com/lists/oss-security/2022/06/09/1
Exploit
Mailing List
Patch
Third Party Advisory
https://github.com/torvalds/linux/commit/d270453a0d9ec10bb8a802a142fb1b3601a83098
Patch
Third Party Advisory
https://lists.debian.org/debian-lts-announce/2022/07/msg00000.html
Mailing List
Third Party Advisory
https://security.netapp.com/advisory/ntap-20220707-0007/
Third Party Advisory
https://www.debian.org/security/2022/dsa-5173
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*

Версия от 4.4 (включая) до 4.9.313 (исключая)

cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*

Версия от 4.10 (включая) до 4.14.278 (исключая)

cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*

Версия от 4.15 (включая) до 4.19.242 (исключая)

cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*

Версия от 4.20 (включая) до 5.4.193 (исключая)

cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*

Версия от 5.5 (включая) до 5.10.115 (исключая)

cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*

Версия от 5.11 (включая) до 5.15.39 (исключая)

cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*

Версия от 5.16 (включая) до 5.17.7 (исключая)

cpe:2.3:o:linux:linux_kernel:5.18:rc1:*:*:*:*:*:*

cpe:2.3:o:linux:linux_kernel:5.18:rc2:*:*:*:*:*:*

cpe:2.3:o:linux:linux_kernel:5.18:rc3:*:*:*:*:*:*

cpe:2.3:o:linux:linux_kernel:5.18:rc4:*:*:*:*:*:*

cpe:2.3:o:linux:linux_kernel:5.18:rc5:*:*:*:*:*:*

Конфигурация 2

Одно из

cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*

cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*

Конфигурация 3

Одновременно

cpe:2.3:o:netapp:h300s_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:netapp:h300s:-:*:*:*:*:*:*:*

Конфигурация 4

Одновременно

cpe:2.3:o:netapp:h500s_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:netapp:h500s:-:*:*:*:*:*:*:*

Конфигурация 5

Одновременно

cpe:2.3:o:netapp:h700s_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:netapp:h700s:-:*:*:*:*:*:*:*

Конфигурация 6

Одновременно

cpe:2.3:o:netapp:h300e_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:netapp:h300e:-:*:*:*:*:*:*:*

Конфигурация 7

Одновременно

cpe:2.3:o:netapp:h500e_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:netapp:h500e:-:*:*:*:*:*:*:*

Конфигурация 8

Одновременно

cpe:2.3:o:netapp:h700e_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:netapp:h700e:-:*:*:*:*:*:*:*

Конфигурация 9

Одновременно

cpe:2.3:o:netapp:h410s_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:netapp:h410s:-:*:*:*:*:*:*:*

Конфигурация 10

Одновременно

cpe:2.3:o:netapp:h410c_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:netapp:h410c:-:*:*:*:*:*:*:*

EPSS

Процентиль: 45%

0.0053

Низкий

7 High

CVSS3

4.4 Medium

CVSS2

Дефекты

CWE-416

CWE-416

Связанные уязвимости

CVE-2022-1734

CVSS3: 7

ubuntu

больше 4 лет назад

A flaw in Linux Kernel found in nfcmrvl_nci_unregister_dev() in drivers/nfc/nfcmrvl/main.c can lead to use after free both read or write when non synchronized between cleanup routine and firmware download routine.

CVE-2022-1734

CVSS3: 7

redhat

больше 4 лет назад

A flaw in Linux Kernel found in nfcmrvl_nci_unregister_dev() in drivers/nfc/nfcmrvl/main.c can lead to use after free both read or write when non synchronized between cleanup routine and firmware download routine.

CVE-2022-1734

CVSS3: 7

msrc

больше 4 лет назад

A flaw in Linux Kernel found in nfcmrvl_nci_unregister_dev() in drivers/nfc/nfcmrvl/main.c can lead to use after free both read or write when non synchronized between cleanup routine and firmware download routine.

CVE-2022-1734

CVSS3: 7

debian

больше 4 лет назад

A flaw in Linux Kernel found in nfcmrvl_nci_unregister_dev() in driver ...

SUSE-SU-2022:2281-1

suse-cvrf

больше 4 лет назад

Security update for the Linux Kernel (Live Patch 44 for SLE 12 SP3)

EPSS

Процентиль: 45%

0.0053

Низкий

7 High

CVSS3

4.4 Medium

CVSS2

Дефекты

CWE-416

CWE-416