CVE-2022-28893

Опубликовано: 11 апр. 2022

Источник: redhat

CVSS3: 6.6

EPSS Низкий

Описание

The SUNRPC subsystem in the Linux kernel through 5.17.2 can call xs_xprt_free before ensuring that sockets are in the intended state.

A use-after-free flaw was found in the Linux kernel’s net/sunrpc/xprt.c function in the Remote Procedure Call (SunRPC) protocol. This flaw allows a local attacker to crash the system, leading to a kernel information leak issue.

Меры по смягчению последствий

This flaw can be mitigated by preventing the affected SUNRPC driver (sunrpc) kernel module from loading during the boot time, ensuring the module is added to the blacklist file.

Refer: How do I blacklist a kernel module to prevent it from loading automatically? https://access.redhat.com/solutions/41278

Затронутые пакеты

Платформа	Пакет	Состояние	Рекомендация	Релиз
Red Hat Enterprise Linux 6	kernel	Out of support scope
Red Hat Enterprise Linux 7	kernel	Out of support scope
Red Hat Enterprise Linux 7	kernel-rt	Out of support scope
Red Hat Enterprise Linux 8	kernel-rt	Fixed	RHSA-2022:7444	08.11.2022
Red Hat Enterprise Linux 8	kernel	Fixed	RHSA-2022:7683	08.11.2022
Red Hat Enterprise Linux 8.6 Extended Update Support	kernel	Fixed	RHSA-2024:0724	07.02.2024
Red Hat Enterprise Linux 9	kernel	Fixed	RHSA-2022:8267	15.11.2022
Red Hat Enterprise Linux 9	kernel-rt	Fixed	RHSA-2022:7933	15.11.2022
Red Hat Enterprise Linux 9	kernel	Fixed	RHSA-2022:8267	15.11.2022
Red Hat Virtualization 4 for Red Hat Enterprise Linux 8	kernel	Fixed	RHSA-2024:0724	07.02.2024

Показывать по

Ссылки на источники

Дополнительная информация

Статус:

Moderate

Дефект:

CWE-416

https://bugzilla.redhat.com/show_bug.cgi?id=2074208kernel: use after free in SUNRPC subsystem

EPSS

Процентиль: 4%

0.0002

Низкий

6.6 Medium

CVSS3

Связанные уязвимости

CVE-2022-28893

CVSS3: 7.8

ubuntu

около 3 лет назад

The SUNRPC subsystem in the Linux kernel through 5.17.2 can call xs_xprt_free before ensuring that sockets are in the intended state.

CVE-2022-28893

CVSS3: 7.8

nvd

около 3 лет назад

The SUNRPC subsystem in the Linux kernel through 5.17.2 can call xs_xprt_free before ensuring that sockets are in the intended state.

CVE-2022-28893

CVSS3: 7.8

msrc

около 3 лет назад

Описание отсутствует

CVE-2022-28893

CVSS3: 7.8

debian

около 3 лет назад

The SUNRPC subsystem in the Linux kernel through 5.17.2 can call xs_xp ...

GHSA-qmh3-rcx6-h2r6

CVSS3: 7.8

github

около 3 лет назад

The SUNRPC subsystem in the Linux kernel through 5.17.2 can call xs_xprt_free before ensuring that sockets are in the intended state.

EPSS

Процентиль: 4%

0.0002

Низкий

6.6 Medium

CVSS3