CVE-2022-0882

CWE-200 — Information ExposureCWE-416 — Use After Free4 documents4 sources
Severity
5.5MEDIUM
EPSS
0.0%
top 96.34%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Google LLC Fuchsia KernelGoogle Fuchsia
Timeline
PublishedMay 3
Latest updateDec 2

Description

A bug exists where an attacker can read the kernel log through exposed Zircon kernel addresses without the required capability ZX_RSRC_KIND_ROOT. It is recommended to upgrade the Fuchsia kernel to 4.1.1 or greater.

CVSS vector

CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:N/A:NExploitability: 0.8 | Impact: 4.0

Affected Packages2 packages

▶CVEListV5google_llc/fuchsia_kernelunspecified — 4.1.1
▶NVDgoogle/fuchsia< 4.1.1

🔴Vulnerability Details

2
GHSA
GHSA-gqmg-mqmp-6h9h: A bug exists where an attacker can read the kernel log through exposed Zircon kernel addresses without the required capability ZX_RSRC_KIND_ROOT↗2022-05-04
▶
CVEList
Illegal access to Kernel log in Fuchsia↗2022-05-03
▶

📋Vendor Advisories

1
Red Hat
vim: use-after-free in did_set_spelllang() in src/spell.c↗2022-12-02
▶
CVE-2022-0882 (MEDIUM CVSS 5.5) | A bug exists where an attacker can | cvebase.io