CVE-2022-0247

CWE-732 — Incorrect Permission Assignment3 documents3 sources
Severity
5.5MEDIUM
EPSS
0.0%
top 96.64%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Google LLC FuchsiaGoogle Fuchsia
Timeline
PublishedFeb 25
Latest updateFeb 26

Description

An issue exists in Fuchsia where VMO data can be modified through access to copy-on-write snapshots. A local attacker could modify objects in the VMO that they do not have permission to. We recommend upgrading past commit d97c05d2301799ed585620a9c5c739d36e7b5d3d or any of the listed versions.

CVSS vector

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:NExploitability: 1.1 | Impact: 5.8

Affected Packages2 packages

▶NVDgoogle/fuchsia< 2022-01-03
▶CVEListV5google_llc/fuchsiaunspecified — 4.1

Patches

Patch: fuchsia.googlesource.com ↗Patch: fuchsia.googlesource.com ↗

🔴Vulnerability Details

2
GHSA
GHSA-hf4w-4cm7-39h3: An issue exists in Fuchsia where VMO data can be modified through access to copy-on-write snapshots↗2022-02-26
▶
CVEList
Write access to VMO data through copy-on-write in Fuchsia↗2022-02-25
▶
CVE-2022-0247 (MEDIUM CVSS 5.5) | An issue exists in Fuchsia where VM | cvebase.io