huzaifas-sidhpurwala/security-commit huggingface dataset:
CVE-2022-24836: nokogiri: ReDoS in HTML encoding detection
Component: nokogiri
Severity: Important
CWE: CWE-1333 (Inefficient Regular Expression Complexity)
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2022-04-11T00:00:00+00:00

A flaw was found in the nokogiri library when processing an inefficient and complex regular expression. This flaw allows an attacker to cause excessive consumption of resources, which affects performance.


Affected upstream versions: < 1.13.4
Fixed upstream versions: v1.13.4
Upstream repository: https://github.com/sparklemotion/nokogiri
Upstream fix commit: e444525ef1634b675cd1cf52d39f4320ef0aecfd
CVE-2022-24903: rsyslog: Heap-based overflow in TCP syslog server
Component: rsyslog
Severity: Important
CWE: CWE-787 (Out-of-bounds Write)
CVSS v3: 8.1 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)
Public date: 2022-05-05T00:00:00+00:00

A flaw was found in rsyslog's reception TCP modules. This flaw allows an attacker to craft a malicious message leading to a heap-based buffer overflow. This issue allows the attacker to corrupt or access data stored in memory, leading to a denial of service in the rsyslog or possible remote code execution.


Affected upstream versions: < 8.2204.1
Fixed upstream versions: v8.2206.0
Upstream repository: https://github.com/rsyslog/rsyslog
Upstream fix commit: f211042ecbb472f9d8beb4678a65d272b6f07705
CVE-2022-2526: systemd-resolved: use-after-free when dealing with DnsStream in resolved-dns-stream.c
Component: systemd-resolved
Severity: Important
CWE: CWE-416 (Use After Free)
CVSS v3: 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Public date: 2022-08-19T00:00:00+00:00

A use-after-free vulnerability was found in systemd. This issue occurs due to the on_stream_io() function and dns_stream_complete() function in 'resolved-dns-stream.c' not incrementing the reference counting for the DnsStream object. Therefore, other functions and callbacks called can dereference the DNSStream object, causing the use-after-free when the reference is still used later.

Statement: This flaw is rated as important because this flaw can easily compromise the confidentiality, integrity, or availability of resources but that allows local or authenticated users to gain additional privileges, allow unauthenticated remote users to view resources that should otherwise be protected by authentication or other controls, allow authenticated remote users to execute arbitrary code, or allow remote users to cause a denial of service. But this flaw does not easily exploit by a remote unauthenticated attacker.

Affected upstream versions: systemd 240
Fixed upstream versions: v240
Upstream repository: https://github.com/systemd/systemd
Upstream fix commit: d973d94dec349fb676fdd844f6fe2ada3538f27c
CVE-2022-25309: fribidi: Heap-buffer-overflow in fribidi_cap_rtl_to_unicode
Component: fribidi
Severity: Moderate
CWE: CWE-122 (Heap-based Buffer Overflow)
CVSS v3: 5.3 (CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:H)
Public date: 2021-12-22T00:00:00+00:00

A heap-based buffer overflow flaw was found in the Fribidi package and affects the fribidi_cap_rtl_to_unicode() function of the fribidi-char-sets-cap-rtl.c file. This flaw allows an attacker to pass a specially crafted file to the Fribidi application with the '--caprtl' option, leading to a crash and causing a denial of service.

Statement: Red Hat Product Security has rated this issue as having a Moderate security impact, and since Red Hat Enterprise Linux 7 is Out-of-Support-Scope, the issue is not currently planned to be addressed in future updates. Only Important and Critical severity flaws will be addressed at this time.

For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/ and Red Hat Enterprise Linux Life Cycle & Updates Policy: https://access.redhat.com/support/policy/updates/errata/.

Affected upstream versions: Fixed in v1.0.12
Fixed upstream versions: v1.0.12
Upstream repository: https://github.com/fribidi/fribidi
Upstream fix commit: f22593b82b5d1668d1997dbccd10a9c31ffea3b3
CVE-2022-2553: booth: authfile directive in booth config file is completely ignored.
Component: booth
Severity: Moderate
CWE: CWE-287 (Improper Authentication)
CVSS v3: 6.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N)
Public date: 2022-07-01T13:20:00+00:00

A flaw was found in booth in the way it handles the authfile directive in configuration files, which causes authentication to be skipped between nodes. As a result, an attacker-controlled node that does not have the correct authentication key does not prevent communication with other nodes in the cluster.


Affected upstream versions: Booth versions after v1.0-85-gda79b8b are vulnerable. Resolved in booth v1.0-263-g35bf0b7.
Fixed upstream versions: v1.1
Upstream repository: https://github.com/ClusterLabs/booth
Upstream fix commit: 35bf0b7b048d715f671eb68974fb6b4af6528c67
CVE-2022-25636: kernel: heap out of bounds write in nf_dup_netdev.c
Component: kernel
Severity: Important
CWE: CWE-787 (Out-of-bounds Write)
CVSS v3: 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2022-02-22T00:00:00+00:00

An out-of-bounds (OOB) memory access flaw was found in nft_fwd_dup_netdev_offload in net/netfilter/nf_dup_netdev.c in the netfilter subcomponent in the Linux kernel due to a heap out-of-bounds write problem. This flaw allows a local attacker with a user account on the system to gain access to out-of-bounds memory, leading to a system crash or a privilege escalation threat.

Statement: This issue affects the Linux kernel packages as shipped with Red Hat Enterprise Linux 8.3 GA onwards. Previous Red Hat Enterprise Linux versions are not affected.

Affected upstream versions: n/a
Fixed upstream versions: v5.17
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf.git
Upstream fix commit: b1a5983f56e371046dcf164f90bfaf704d2b89f6
CVE-2022-25845: fastjson: autoType shutdown restriction bypass leads to deserialization
Component: fastjson
Severity: Important
CWE: CWE-502 (Deserialization of Untrusted Data)
CVSS v3: 8.1 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)
Public date: 2022-06-10T00:00:00+00:00

A flaw was found in com.alibaba:fastjson, a fast JSON parser/generator for Java. Affected versions of this package are vulnerable to Deserialization of Untrusted Data by bypassing the default autoType shutdown restrictions, which is possible under certain conditions.


Affected upstream versions: unspecified < 1.2.83
Fixed upstream versions: 1.2.83
Upstream repository: https://github.com/alibaba/fastjson
Upstream fix commit: 8f3410f81cbd437f7c459f8868445d50ad301f15
CVE-2022-25857: snakeyaml: Denial of Service due to missing nested depth limitation for collections
Component: snakeyaml
Severity: Important
CWE: CWE-400 (Uncontrolled Resource Consumption)
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2022-08-30T00:00:00+00:00

A flaw was found in the org.yaml.snakeyaml package. This flaw allows an attacker to cause a denial of service (DoS) due to missing nested depth limitation for collections.

Statement: For RHEL-8 it's downgraded to moderate because "snakeyaml" itself in RHEL 8 or RHEL-9 isn't shipped and "prometheus-jmx-exporter" is needed as build dependency. And it's not directly exploitable, hence severity marked as moderate.
Red Hat Integration and AMQ products are not vulnerable to this flaw, so their severity has been lowered to moderate.
Red Hat Single Sign-On uses snakeyaml from liquibase-core and is only used when performing migrations and would require administrator privileges to execute, hence severity marked as Low.
Red Hat Fuse 7 is now in Maintenance Support Phase and details about its fix should be present soon. However, Red Hat Fuse Online (Syndesis) does will not contain the fix for this flaw.

Affected upstream versions: unspecified < 1.31
Fixed upstream versions: 1.31, unspecified
Upstream repository: https://bitbucket.org/snakeyaml/snakeyaml
Upstream fix commit: fc300780da21f4bb92c148bc90257201220cf174
CVE-2022-25858: terser: insecure use of regular expressions leads to ReDoS
Component: terser
Severity: Moderate
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2022-07-15T00:00:00+00:00

A vulnerability was found in the terser package. Affected versions of this package are vulnerable to Regular expression denial of service (ReDoS) attacks, affecting system availability.

Statement: For OpenShift Do (odo) product terser is shipped only for using in static page generators for upstream, thus this represents no security risk.

Affected upstream versions: unspecified < 4.8.1, 5.0.0 < unspecified, unspecified < 5.14.2
Fixed upstream versions: 4.8.1, 5.14.2, unspecified
Upstream repository: https://github.com/terser/terser
Upstream fix commit: a4da7349fdc92c05094f41d33d06d8cd4e90e76b
CVE-2022-25883: nodejs-semver: Regular expression denial of service
Component: nodejs-semver
Severity: Moderate
CWE: CWE-1333 (Inefficient Regular Expression Complexity)
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2023-06-21T00:00:00+00:00

A Regular Expression Denial of Service (ReDoS) vulnerability was discovered in node-semver package via the 'new Range' function. This issue could allow an attacker to pass untrusted malicious regex user data as a range, causing the service to excessively consume CPU depending upon the input size, resulting in a denial of service.

Statement: This vulnerability is rated Moderate for Red Hat Products versus NVD's High due to deployment context. The flaw in node-semver's new Range() function causes catastrophic regex backtracking on crafted input, leading to CPU exhaustion. However, exploitation requires untrusted input passed directly to the parser. So node-semver is a build-time dev dependency, not present in runtime environment in RHACM, and the functionality is additionally protected behind OAuth authentication, further limiting attack surface.

Affected upstream versions: <= v7.5.1
Fixed upstream versions: 7.5.2
Upstream repository: https://github.com/npm/node-semver
Upstream fix commit: 717534ee353682f3bcf33e60a8af4292626d4441
CVE-2022-25897: sdk-server: Denial of Service
Component: sdk-server
Severity: Moderate
CWE: CWE-770 (Allocation of Resources Without Limits or Throttling)
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2022-09-08T00:00:00+00:00

A flaw was found in the Eclipse Milo SDK Server. This flaw allows an attacker to consume the application memory, leading to a denial of service by sending specific requests.


Affected upstream versions: unspecified < 0.6.8
Fixed upstream versions: 0.6.8
Upstream repository: https://github.com/eclipse/milo
Upstream fix commit: 4534381760d7d9f0bf00cbf6a8449bb0d13c6ce5
CVE-2022-25914: jib-core: RCE via the isDockerInstalled
Component: jib-core
Severity: Important
CWE: CWE-20 (Improper Input Validation)
CVSS v3: 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Public date: 2022-09-08T00:00:00+00:00

A flaw was found in the jib-core package. This flaw allows an attacker to execute remote code into its target.


Affected upstream versions: unspecified < 0.22.0
Fixed upstream versions: 0.22.0
Upstream repository: https://github.com/GoogleContainerTools/jib
Upstream fix commit: 67fa40bc2c484da0546333914ea07a89fe44eaaf
CVE-2022-25927: ua-parser-js: ReDoS vulnerability via the trim() function
Component: ua-parser-js
Severity: Moderate
CWE: CWE-1333 (Inefficient Regular Expression Complexity)
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2023-01-22T00:00:00+00:00

A flaw was found in ua-parser-js. This issue could allow a malicious user to trigger a regular expression denial of service (ReDoS) via the trim() function.


Affected upstream versions: 0.7.30 < 0.7.33, 0.8.1 < 1.0.33
Fixed upstream versions: 0.7.33, 1.0.33
Upstream repository: https://github.com/faisalman/ua-parser-js
Upstream fix commit: a6140a17dd0300a35cfc9cff999545f267889411
CVE-2022-26353: QEMU: virtio-net: map leaking on error during receive
Component: QEMU
Severity: Moderate
CWE: CWE-772 (Missing Release of Resource after Effective Lifetime)
CVSS v3: 7.5 (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H)
Public date: 2022-03-08T00:00:00+00:00

A flaw was found in the virtio-net device of QEMU. This flaw was inadvertently introduced with the fix for CVE-2021-3748, which forgot to unmap the cached virtqueue elements on error, leading to memory leakage, use-after-free or other unexpected results. A malicious privileged guest could exploit this issue to crash QEMU or potentially execute arbitrary code within the context of the QEMU process on the host.

Statement: This issue affects the versions of `qemu-kvm` as shipped with Red Hat Enterprise Linux 8 and Red Hat Enterprise Linux 8 Advanced Virtualization. A future update may address this flaw.

Affected upstream versions: Affected QEMU version: 6.2.0
Fixed upstream versions: v7.0.0
Upstream repository: https://gitlab.com/qemu-project/qemu
Upstream fix commit: abe300d9d894f7138e1af7c8e9c88c04bfe98b37
CVE-2022-26354: QEMU: vhost-vsock: missing virtqueue detach on error can lead to memory leak
Component: QEMU
Severity: Low
CWE: CWE-772 (Missing Release of Resource after Effective Lifetime)
CVSS v3: 2.5 (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:N/I:N/A:L)
Public date: 2022-02-28T00:00:00+00:00

A flaw was found in the vhost-vsock device of QEMU. In case of error, an invalid element was not detached from the virtqueue before freeing its memory, leading to memory leakage and other unexpected results.

Statement: This issue affects the versions of `qemu-kvm` as shipped with Red Hat Enterprise Linux 8 and Red Hat Enterprise Linux 8 Advanced Virtualization. A future update may address this flaw.

Affected upstream versions: Affected QEMU versions <= 6.2.0
Fixed upstream versions: v7.0.0
Upstream repository: https://gitlab.com/qemu-project/qemu
Upstream fix commit: 8d1b247f3748ac4078524130c6d7ae42b6140aaf
CVE-2022-2639: kernel: openvswitch: integer underflow leads to out-of-bounds write in reserve_sfa_size()
Component: kernel
Severity: Important
CWE: CWE-681 (Incorrect Conversion between Numeric Types)
CVSS v3: 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2022-04-15T00:00:00+00:00

An integer coercion error was found in the openvswitch kernel module. Given a sufficiently large number of actions, while copying and reserving memory for a new action of a new flow, the reserve_sfa_size() function does not return -EMSGSIZE as expected, potentially leading to an out-of-bounds write access. This flaw allows a local user to crash or potentially escalate their privileges on the system.

Statement: The `openvswitch` is not supported out of the Layered Products subscriptions (OCP, OSP, RHV). There are no Layered Products based on Red Hat Enterprise Linux 7 at the present time. Therefore, this CVE is not planned to be addressed on Red Hat Enterprise Linux 7.

Affected upstream versions: kernel 5.18
Fixed upstream versions: v5.18
Upstream repository: https://github.com/torvalds/linux
Upstream fix commit: cefa91b2332d7009bc0be5d951d6cbbf349f90f8
CVE-2022-26520: postgresql-jdbc: Arbitrary File Write Vulnerability
Component: postgresql-jdbc
Severity: Moderate
CWE: CWE-552 (Files or Directories Accessible to External Parties)
CVSS v3: 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Public date: 2022-02-01T00:00:00+00:00

A flaw was found in Postgres JDBC. This flaw allows an attacker to use a method to write arbitrary files through the connection properties settings. For example, an attacker can create an executable file under the server the application is running and make it a new part of the application or server.

Statement: Red Hat informs that although there's a difference from NVD CVSSv3 score there's a especial occasion in this CVE that maintain it as a moderate. The scenario for an attacker to get a benefit in this situation requires them to have access to modify a configuration file and write a file where it's needed. This require non-default configuration and also it's not expected to allow an untrusted user to perform this kind of setting.

Affected upstream versions: n/a
Upstream repository: https://github.com/pgjdbc/pgjdbc
Upstream fix commit: 017b929977b4f85795f9ad2fa5de6e80978b8ccc
CVE-2022-26691: cups: authorization bypass when using "local" authorization
Component: cups
Severity: Important
CWE: CWE-288 (Authentication Bypass Using an Alternate Path or Channel)
CVSS v3: 6.7 (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Public date: 2022-05-25T15:00:00+00:00

An authorization vulnerability was found in the CUPS printing system. This security vulnerability occurs when local authorization happens. This flaw allows an attacker to authenticate to CUPS as root/admin without the 32-byte secret key and perform arbitrary code execution.


Affected upstream versions: unspecified < 12.3, unspecified < 11.6, unspecified < 2022
Fixed upstream versions: 11.6, 12.3, 2022
Upstream repository: https://github.com/OpenPrinting/cups
Upstream fix commit: de4f8c196106033e4c372dce3e91b9d42b0b9444
CVE-2022-27239: cifs-utils: stack-based buffer overflow mount.cifs may lead to local privilege escalation to root
Component: cifs-utils
Severity: Moderate
CWE: CWE-787 (Out-of-bounds Write)
CVSS v3: 7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2022-04-27T00:00:00+00:00

A stack-based buffer overflow issue was found in cifs-utils. Parsing the mount.cifs ip command-line argument can lead to local attackers gaining root privileges.

Statement: The mount.cifs binary file is shipped without setuid privileges as default which prevents an attacker to gain root privileges hence lowering the flaw impact.

Affected upstream versions: n/a
Upstream repository: https://github.com/piastry/cifs-utils
Upstream fix commit: 955fb147e97a6a74e1aaa65766de91e2c1479765
CVE-2022-27649: podman: Default inheritable capabilities for linux container should be empty
Component: podman
Severity: Moderate
CWE: CWE-276 (Incorrect Default Permissions)
CVSS v3: 5 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L)
Public date: 2022-03-30T12:00:00+00:00

A flaw was found in Podman, where containers were started incorrectly with non-empty default permissions. A vulnerability was found in Moby (Docker Engine), where containers were started incorrectly with non-empty inheritable Linux process capabilities. This flaw allows an attacker with access to programs with inheritable file capabilities to elevate those capabilities to the permitted set when execve(2) runs.

Statement: This issue is related to the general vulnerability found in Moby (Docker Engine), which has been assigned CVE-2022-24769.

Affected upstream versions: Affects all versions before v4.0.3, Fixed in - v4.0.3
Fixed upstream versions: v4.1.0
Upstream repository: https://github.com/containers/podman
Upstream fix commit: aafa80918a245edcbdaceb1191d749570f1872d0
CVE-2022-27650: crun: Default inheritable capabilities for linux container should be empty
Component: crun
Severity: Moderate
CWE: CWE-276 (Incorrect Default Permissions)
CVSS v3: 5.6 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L)
Public date: 2022-03-30T12:00:00+00:00

A flaw was found in crun where containers were incorrectly started with non-empty default permissions. A vulnerability was found in Moby (Docker Engine) where containers were started incorrectly with non-empty inheritable Linux process capabilities. This flaw allows an attacker with access to programs with inheritable file capabilities to elevate those capabilities to the permitted set when execve(2) runs.

Statement: This issue is related to the general vulnerability found in Moby (Docker Engine), which has been assigned CVE-2022-24769.

Among the supported OpenShift Container Platform releases, only v4.10 is affected by this flaw.

Affected upstream versions: Affects crun v1.4.3 and prior, Fixed in – v1.4.4
Fixed upstream versions: 1.4.4
Upstream repository: https://github.com/containers/crun
Upstream fix commit: 1aeeed2e4fdeffb4875c0d0b439915894594c8c6
CVE-2022-27651: buildah: Default inheritable capabilities for linux container should be empty
Component: buildah
Severity: Moderate
CWE: CWE-276 (Incorrect Default Permissions)
CVSS v3: 4.8 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N)
Public date: 2022-03-30T12:00:00+00:00

A flaw was found in buildah, where containers were incorrectly started with non-empty default permissions. A bug was found in Moby (Docker Engine) where containers were incorrectly started with non-empty inheritable Linux process capabilities. This flaw allows an attacker with access to programs with inheritable file capabilities to elevate those capabilities to the permitted set when execve(2) runs.

Statement: This issue is related to the general vulnerability found in Moby (Docker Engine), which has been assigned CVE-2022-24769.

The impact for OpenShift Container Platform is set to LOW as Buildah was shipped but is not being used. No update is planned at this time.

Affected upstream versions: Affects buildah v1.24.0 and prior, Fixed in - v1.25.0
Fixed upstream versions: v1.25.0
Upstream repository: https://github.com/containers/buildah
Upstream fix commit: e7e55c988c05dd74005184ceb64f097a0cfe645b
CVE-2022-27666: kernel: buffer overflow in IPsec ESP transformation code
Component: kernel
Severity: Important
CWE: CWE-122 (Heap-based Buffer Overflow)
CVSS v3: 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2022-03-11T06:30:00+00:00

A heap buffer overflow flaw was found in IPsec ESP transformation code in net/ipv4/esp4.c and net/ipv6/esp6.c. This flaw allows a local attacker with a normal user privilege to overwrite kernel heap objects and may cause a local privilege escalation threat.


Affected upstream versions: n/a
Fixed upstream versions: v5.17
Upstream repository: https://github.com/torvalds/linux
Upstream fix commit: ebe48d368e97d007bfeb76fcb065d6cfc4c96645
CVE-2022-27950: kernel: memory leak in drivers/hid/hid-elo.c
Component: kernel
Severity: Moderate
CWE: CWE-401 (Missing Release of Memory after Effective Lifetime)
CVSS v3: 5.1 (CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2022-03-13T00:00:00+00:00

A memory leak flaw was found in elo_probe in drivers/hid/hid-elo.c in the Human Interface Devices (HID) in the Linux kernel. This issue allows an attacker to cause a denial of service when hid_parse() in elo_probe() fails.


Affected upstream versions: n/a
Fixed upstream versions: v5.17
Upstream repository: https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git
Upstream fix commit: 817b8b9c5396d2b2d92311b46719aad5d3339dbe
CVE-2022-28388: kernel: double free in usb_8dev_start_xmit in drivers/net/can/usb/usb_8dev.c
Component: kernel
Severity: Moderate
CWE: CWE-415 (Double Free)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2022-04-04T00:00:00+00:00

A double-free flaw was found in the Linux kernel's USB2CAN interface implementation. This issue could allow a local user to crash the system.

Statement: This issue is Moderate because this case doesn't lead to a kernel crash as result of the pointers reference check preventing actual second memory free. The only known attack scenario is the possibility of a denial of service.

Affected upstream versions: n/a
Fixed upstream versions: v5.18
Upstream repository: https://github.com/torvalds/linux
Upstream fix commit: 3d3925ff6433f98992685a9679613a2cc97f3ce2
CVE-2022-28390: kernel: double free in ems_usb_start_xmit in drivers/net/can/usb/ems_usb.c
Component: kernel
Severity: Moderate
CWE: CWE-415 (Double Free)
CVSS v3: 7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2022-04-04T00:00:00+00:00

A double-free flaw was found in the Linux kernel in the ems_usb_start_xmit function. This flaw allows an attacker to create a memory leak and corrupt the underlying data structure by calling free more than once.


Affected upstream versions: n/a
Fixed upstream versions: v5.18
Upstream repository: https://github.com/torvalds/linux
Upstream fix commit: c70222752228a62135cee3409dccefd494a24646