CVE-2022-0322 — Incorrect Conversion between Numeric Types in Kernel
Severity
5.5MEDIUMNVD
CISA8.8
EPSS
0.1%
top 74.44%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedMar 25
Latest updateFeb 14
Description
A flaw was found in the sctp_make_strreset_req function in net/sctp/sm_make_chunk.c in the SCTP network protocol in the Linux kernel with a local user privilege access. In this flaw, an attempt to use more buffer than is allocated triggers a BUG_ON issue, leading to a denial of service (DOS).
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HExploitability: 1.8 | Impact: 3.6
Affected Packages11 packages
Also affects: Fedora 35
Patches
🔴Vulnerability Details
3GHSA▶
GHSA-g6mc-765r-fwwj: A flaw was found in the sctp_make_strreset_req function in net/sctp/sm_make_chunk↗2022-03-26
OSV▶
CVE-2022-0322: A flaw was found in the sctp_make_strreset_req function in net/sctp/sm_make_chunk↗2022-03-25
CVEList▶
CVE-2022-0322: A flaw was found in the sctp_make_strreset_req function in net/sctp/sm_make_chunk↗2022-03-25
📋Vendor Advisories
7Microsoft▶
A flaw was found in the sctp_make_strreset_req function in net/sctp/sm_make_chunk.c in the SCTP network protocol in the Linux kernel with a local user privilege access. In this flaw an attempt to use ↗2022-03-08