CVE-2022-0433 — Use of Uninitialized Resource in Kernel

CWE-908 — Use of Uninitialized ResourceCWE-476 — NULL Pointer Dereference7 documents6 sources
Severity
5.5MEDIUMNVD
OSV7.8
EPSS
0.0%
top 88.35%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
6
VIMLinux KernelFedoraproject Fedora+3 more
Timeline
PublishedMar 10
Latest updateMar 20

Description

A NULL pointer dereference flaw was found in the Linux kernel's BPF subsystem in the way a user triggers the map_get_next_key function of the BPF bloom filter. This flaw allows a local user to crash the system. This flaw affects Linux kernel versions prior to 5.17-rc1.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HExploitability: 1.8 | Impact: 3.6

Affected Packages6 packages

▶CVEListV5linux/linux_kernelLinux kernel versions prior to 5.17-rc1
▶debiandebian/linux

Also affects: Fedora 35

Patches

Patch: bugzilla.redhat.com ↗Patch: git.kernel.org ↗Patch: bugzilla.redhat.com ↗

🔴Vulnerability Details

3
OSV
vim vulnerabilities↗2023-03-20
▶
GHSA
GHSA-rqh7-q69f-f8vq: A NULL pointer dereference flaw was found in the Linux kernel's BPF subsystem in the way a user triggers the map_get_next_key function of the BPF bloo↗2022-03-11
▶
OSV
CVE-2022-0433: A NULL pointer dereference flaw was found in the Linux kernel's BPF subsystem in the way a user triggers the map_get_next_key function of the BPF bloo↗2022-03-10
▶

📋Vendor Advisories

3
Microsoft
A NULL pointer dereference flaw was found in the Linux kernel's BPF subsystem in the way a user triggers the map_get_next_key function of the BPF bloom filter. This flaw allows a local user to crash t↗2022-03-08
▶
Red Hat
kernel: missing initialization in bloom filter map in kernel/bpf/bloom_filter.c can lead to DoS↗2022-01-10
▶
Debian
CVE-2022-0433: linux - A NULL pointer dereference flaw was found in the Linux kernel's BPF subsystem in...↗2022
▶