CVE-2022-2011
published 2022-07-28CVE-2022-2011: Use after free in ANGLE in Google Chrome prior to 102.0.5005.115 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
PriorityP343high8.8CVSS 3.1
AVNACLPRNUIRSUCHIHAH
EPSS
0.88%
55.1th percentile
Use after free in ANGLE in Google Chrome prior to 102.0.5005.115 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Affected
10 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| chromium | chromium | >= 0 < 102.0.5005.115-1~deb11u1 | 102.0.5005.115-1~deb11u1 |
| chromium | chromium | >= 0 < 102.0.5005.115-1 | 102.0.5005.115-1 |
| chromium | chromium | >= 0 < 102.0.5005.115-1 | 102.0.5005.115-1 |
| chromium | chromium | >= 0 < 102.0.5005.115-1 | 102.0.5005.115-1 |
| debian | chromium | < chromium 102.0.5005.115-1 (bookworm) | chromium 102.0.5005.115-1 (bookworm) |
| fedoraproject | fedora | — | — |
| chrome | < 102.0.5005.115 | 102.0.5005.115 | |
| chrome | >= unspecified < 102.0.5005.115 | 102.0.5005.115 | |
| chrome_chrome | — | — | |
| msrc | microsoft_edge | — | — |
CVSS provenance
nvdv3.18.8HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
osv8.8HIGH
cisa9.8CRITICAL
vendor_debian8.8HIGH
vendor_msrc8.8HIGH
vendor_redhat7.8HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
kernel: dm raid: fix address sanitizer warning in raid_status
vendor_redhat·2025-06-18·CVSS 7.1
CVE-2022-50084 [HIGH] CWE-843 kernel: dm raid: fix address sanitizer warning in raid_status
kernel: dm raid: fix address sanitizer warning in raid_status
In the Linux kernel, the following vulnerability has been resolved:
dm raid: fix address sanitizer warning in raid_status
There is this warning when using a kernel with the address sanitizer
and running this testsuite:
https://gitlab.com/cki-project/kernel-tests/-/tree/main/storage/swraid/scsi_raid
BUG: KASAN: slab-out-of-bounds in raid_status+0x1747/0x2820 [dm_raid]
Read of size 4 at addr ffff888079d2c7e8 by task lvcreate/13319
CPU: 0 PID: 13319 Comm: lvcreate Not tainted 5.18.0-0.rc3. #1
Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011
Call Trace:
dump_stack_lvl+0x6a/0x9c
print_address_description.constprop.0+0x1f/0x1e0
print_report.cold+0x55/0x244
kasan_report+0xc9/0x100
raid_status+0x1747/0x2820 [dm_raid]
dm_ima_measure_o
Red Hat
kernel: bpf: Fix a btf decl_tag bug when tagging a function
vendor_redhat·2025-02-26·CVSS 5.5
CVE-2022-49228 [MEDIUM] kernel: bpf: Fix a btf decl_tag bug when tagging a function
kernel: bpf: Fix a btf decl_tag bug when tagging a function
In the Linux kernel, the following vulnerability has been resolved:
bpf: Fix a btf decl_tag bug when tagging a function
syzbot reported a btf decl_tag bug with stack trace below:
general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] PREEMPT SMP KASAN
KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]
CPU: 0 PID: 3592 Comm: syz-executor914 Not tainted 5.16.0-syzkaller-11424-gb7892f7d5cb2 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:btf_type_vlen include/linux/btf.h:231 [inline]
RIP: 0010:btf_decl_tag_resolve+0x83e/0xaa0 kernel/bpf/btf.c:3910
...
Call Trace:
btf_resolve+0x251/0x1020 kernel/bpf/btf.c:4198
btf_check_all
Red Hat
kernel: tipc: fix use-after-free Read in tipc_named_reinit
vendor_redhat·2025-02-26·CVSS 7.8
CVE-2022-49696 [HIGH] CWE-416 kernel: tipc: fix use-after-free Read in tipc_named_reinit
kernel: tipc: fix use-after-free Read in tipc_named_reinit
In the Linux kernel, the following vulnerability has been resolved:
tipc: fix use-after-free Read in tipc_named_reinit
syzbot found the following issue on:
BUG: KASAN: use-after-free in tipc_named_reinit+0x94f/0x9b0
net/tipc/name_distr.c:413
Read of size 8 at addr ffff88805299a000 by task kworker/1:9/23764
CPU: 1 PID: 23764 Comm: kworker/1:9 Not tainted
5.18.0-rc4-syzkaller-00878-g17d49e6e8012 #0
Hardware name: Google Compute Engine/Google Compute Engine,
BIOS Google 01/01/2011
Workqueue: events tipc_net_finalize_work
Call Trace:
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106
print_address_description.constprop.0.cold+0xeb/0x495
mm/kasan/report.c:313
print_report mm/kasan/report.c:429 [in
Red Hat
kernel: bonding: fix missed rcu protection
vendor_redhat·2025-02-26·CVSS 5.5
CVE-2022-49456 [MEDIUM] CWE-413 kernel: bonding: fix missed rcu protection
kernel: bonding: fix missed rcu protection
In the Linux kernel, the following vulnerability has been resolved:
bonding: fix missed rcu protection
When removing the rcu_read_lock in bond_ethtool_get_ts_info() as
discussed [1], I didn't notice it could be called via setsockopt,
which doesn't hold rcu lock, as syzbot pointed:
stack backtrace:
CPU: 0 PID: 3599 Comm: syz-executor317 Not tainted 5.18.0-rc5-syzkaller-01392-g01f4685797a5 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106
bond_option_active_slave_get_rcu include/net/bonding.h:353 [inline]
bond_ethtool_get_ts_info+0x32c/0x3a0 drivers/net/bonding/bond_main.c:5595
__ethtool_get_ts_info+0x173/
Red Hat
kernel: netfilter: nf_tables: unregister flowtable hooks on netns exit
vendor_redhat·2024-08-22·CVSS 5.5
CVE-2022-48935 [MEDIUM] CWE-416 kernel: netfilter: nf_tables: unregister flowtable hooks on netns exit
kernel: netfilter: nf_tables: unregister flowtable hooks on netns exit
In the Linux kernel, the following vulnerability has been resolved:
netfilter: nf_tables: unregister flowtable hooks on netns exit
Unregister flowtable hooks before they are releases via
nf_tables_flowtable_destroy() otherwise hook core reports UAF.
BUG: KASAN: use-after-free in nf_hook_entries_grow+0x5a7/0x700 net/netfilter/core.c:142 net/netfilter/core.c:142
Read of size 4 at addr ffff8880736f7438 by task syz-executor579/3666
CPU: 0 PID: 3666 Comm: syz-executor579 Not tainted 5.16.0-rc5-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
__dump_stack lib/dump_stack.c:88 [inline]
__dump_stack lib/dump_stack.c:88 [inline] lib/dump_stack.c:106
dump_stack_lv
Red Hat
kernel: ipmr,ip6mr: acquire RTNL before calling ip[6]mr_free_table() on failure path
vendor_redhat·2024-07-16·CVSS 5.5
CVE-2022-48810 [MEDIUM] CWE-414 kernel: ipmr,ip6mr: acquire RTNL before calling ip[6]mr_free_table() on failure path
kernel: ipmr,ip6mr: acquire RTNL before calling ip[6]mr_free_table() on failure path
In the Linux kernel, the following vulnerability has been resolved:
ipmr,ip6mr: acquire RTNL before calling ip[6]mr_free_table() on failure path
ip[6]mr_free_table() can only be called under RTNL lock.
RTNL: assertion failed at net/core/dev.c (10367)
WARNING: CPU: 1 PID: 5890 at net/core/dev.c:10367 unregister_netdevice_many+0x1246/0x1850 net/core/dev.c:10367
Modules linked in:
CPU: 1 PID: 5890 Comm: syz-executor.2 Not tainted 5.16.0-syzkaller-11627-g422ee58dc0ef #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:unregister_netdevice_many+0x1246/0x1850 net/core/dev.c:10367
Code: 0f 85 9b ee ff ff e8 69 07 4b fa ba 7f 28 00 00 48 c7 c6 00 90 ae 8a 48 c7 c
Red Hat
kernel: fs/proc: task_mmu.c: don't read mapcount for migration entry
vendor_redhat·2024-07-16·CVSS 5.5
CVE-2022-48802 [MEDIUM] kernel: fs/proc: task_mmu.c: don't read mapcount for migration entry
kernel: fs/proc: task_mmu.c: don't read mapcount for migration entry
In the Linux kernel, the following vulnerability has been resolved:
fs/proc: task_mmu.c: don't read mapcount for migration entry
The syzbot reported the below BUG:
kernel BUG at include/linux/page-flags.h:785!
invalid opcode: 0000 [#1] PREEMPT SMP KASAN
CPU: 1 PID: 4392 Comm: syz-executor560 Not tainted 5.16.0-rc6-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:PageDoubleMap include/linux/page-flags.h:785 [inline]
RIP: 0010:__page_mapcount+0x2d2/0x350 mm/util.c:744
Call Trace:
page_mapcount include/linux/mm.h:837 [inline]
smaps_account+0x470/0xb10 fs/proc/task_mmu.c:466
smaps_pte_entry fs/proc/task_mmu.c:538 [inline]
smaps_pte_range+0x611/0x1250 fs/proc/tas
Red Hat
kernel: RDMA/ucma: Protect mc during concurrent multicast leaves
vendor_redhat·2024-06-20·CVSS 7.8
CVE-2022-48726 [HIGH] CWE-416 kernel: RDMA/ucma: Protect mc during concurrent multicast leaves
kernel: RDMA/ucma: Protect mc during concurrent multicast leaves
In the Linux kernel, the following vulnerability has been resolved:
RDMA/ucma: Protect mc during concurrent multicast leaves
Partially revert the commit mentioned in the Fixes line to make sure that
allocation and erasing multicast struct are locked.
BUG: KASAN: use-after-free in ucma_cleanup_multicast drivers/infiniband/core/ucma.c:491 [inline]
BUG: KASAN: use-after-free in ucma_destroy_private_ctx+0x914/0xb70 drivers/infiniband/core/ucma.c:579
Read of size 8 at addr ffff88801bb74b00 by task syz-executor.1/25529
CPU: 0 PID: 25529 Comm: syz-executor.1 Not tainted 5.16.0-rc7-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
__dump_stack lib/dump_stack.c:88 [inli
Microsoft
Chromium: CVE-2022-2011 Use after free in ANGLE
vendor_msrc·2022-06-14·CVSS 8.8
CVE-2022-2011 [HIGH] Chromium: CVE-2022-2011 Use after free in ANGLE
Chromium: CVE-2022-2011 Use after free in ANGLE
Description: This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information.
FAQ: What is the version information for this release?
Microsoft Edge Version
Date Released
Based on Chromium Version
102.0.1245.41
6/13/2022
102.0.5005.115
FAQ: Why is this Chrome CVE included in the Security Update Guide?
The vulnerability assigned to this CVE is in Chromium Open Source Software (OSS) which is consumed by Microsoft Edge (Chromium-based). It is being documented in the Security Update Guide to announce that the latest version of Microsoft Edge (Chromium-based) is no longer vulnerable.
How can I see the version of the browser?
In you
Chrome
Stable Channel Update for Desktop: CVE-2022-2011
vendor_chrome·2022-06-09·CVSS 8.8
CVE-2022-2011 [HIGH] Stable Channel Update for Desktop: CVE-2022-2011
Stable Channel Update for Desktop
CVE-2022-2011: Use after free in ANGLE. Reported by SeongHwan Park (SeHwa) on 2022-05-31 We would also like to thank all security researchers that worked with us during the development cycle to prevent security bugs from ever reaching the stable channel
Severity: high
CISA
Adobe Reader and Acrobat Universal 3D Memory Corruption Vulnerability
cisa·2022-06-08·CVSS 9.8
CVE-2011-2462 [CRITICAL] CWE-787 Adobe Reader and Acrobat Universal 3D Memory Corruption Vulnerability
Vulnerability: Adobe Reader and Acrobat Universal 3D Memory Corruption Vulnerability
Affected: Adobe Reader and Acrobat
The Universal 3D (U3D) component in Adobe Reader and Acrobat contains a memory corruption vulnerability which could allow remote attackers to execute code or cause denial-of-service (DoS).
Required Action: Apply updates per vendor instructions.
Notes: https://nvd.nist.gov/vuln/detail/CVE-2011-2462
Remediation Due Date: 2022-06-22
CISA
Adobe Flash Player Unspecified Vulnerability
cisa·2022-06-08·CVSS 7.8
CVE-2011-0609 [HIGH] Adobe Flash Player Unspecified Vulnerability
Vulnerability: Adobe Flash Player Unspecified Vulnerability
Affected: Adobe Flash Player
Adobe Flash Player contains an unspecified vulnerability that allows remote attackers to execute code or cause denial-of-service (DoS).
Required Action: The impacted product is end-of-life and should be disconnected if still in use.
Notes: https://nvd.nist.gov/vuln/detail/CVE-2011-0609
Remediation Due Date: 2022-06-22
CISA
Oracle Java SE Runtime Environment (JRE) Arbitrary Code Execution Vulnerability
cisa·2022-03-03·CVSS 9.8
CVE-2011-3544 [CRITICAL] Oracle Java SE Runtime Environment (JRE) Arbitrary Code Execution Vulnerability
Vulnerability: Oracle Java SE Runtime Environment (JRE) Arbitrary Code Execution Vulnerability
Affected: Oracle Java SE JDK and JRE
An access control vulnerability exists in the Applet Rhino Script Engine component of Oracle's Java Runtime Environment allows an attacker to remotely execute arbitrary code.
Required Action: Apply updates per vendor instructions.
Notes: https://nvd.nist.gov/vuln/detail/CVE-2011-3544
Remediation Due Date: 2022-03-24
CISA
Microsoft Forefront TMG Remote Code Execution Vulnerability
cisa·2022-03-03·CVSS 9.8
CVE-2011-1889 [CRITICAL] CWE-119 Microsoft Forefront TMG Remote Code Execution Vulnerability
Vulnerability: Microsoft Forefront TMG Remote Code Execution Vulnerability
Affected: Microsoft Forefront Threat Management Gateway (TMG)
A remote code execution vulnerability exists in the Forefront Threat Management Gateway (TMG) Firewall Client Winsock provider that could allow code execution in the security context of the client application.
Required Action: Apply updates per vendor instructions.
Notes: https://nvd.nist.gov/vuln/detail/CVE-2011-1889
Remediation Due Date: 2022-03-24
Debian
CVE-2022-2011: chromium - Use after free in ANGLE in Google Chrome prior to 102.0.5005.115 allowed a remot...
vendor_debian·2022·CVSS 8.8
CVE-2022-2011 [HIGH] CVE-2022-2011: chromium - Use after free in ANGLE in Google Chrome prior to 102.0.5005.115 allowed a remot...
Use after free in ANGLE in Google Chrome prior to 102.0.5005.115 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Scope: local
bookworm: resolved (fixed in 102.0.5005.115-1)
bullseye: resolved (fixed in 102.0.5005.115-1~deb11u1)
forky: resolved (fixed in 102.0.5005.115-1)
sid: resolved (fixed in 102.0.5005.115-1)
trixie: resolved (fixed in 102.0.5005.115-1)
GHSA
GHSA-67vw-x24w-99pv: Use after free in ANGLE in Google Chrome prior to 102
ghsa_unreviewed·2022-07-29
CVE-2022-2011 [HIGH] CWE-416 GHSA-67vw-x24w-99pv: Use after free in ANGLE in Google Chrome prior to 102
Use after free in ANGLE in Google Chrome prior to 102.0.5005.115 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
OSV
CVE-2022-2011: Use after free in ANGLE in Google Chrome prior to 102
osv·2022-07-28·CVSS 8.8
CVE-2022-2011 [HIGH] CVE-2022-2011: Use after free in ANGLE in Google Chrome prior to 102
Use after free in ANGLE in Google Chrome prior to 102.0.5005.115 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
No detection rules found.
No public exploits indexed.
Qualys
June 2022 Patch Tuesday | Microsoft Releases 55 Vulnerabilities With 3 Critical; Adobe Releases 6 Advisories, 46 Vulnerabilities With 40 Critical.
blogs_qualys·2022-06-14·CVSS 7.8
[HIGH] June 2022 Patch Tuesday | Microsoft Releases 55 Vulnerabilities With 3 Critical; Adobe Releases 6 Advisories, 46 Vulnerabilities With 40 Critical.
## Table of Contents
Microsoft Patch Tuesday Summary
The June 2022 Microsoft Vulnerabilities Are Classified As Follows:
Notable Microsoft Vulnerabilities Patched
Microsoft Guidance on Intel Processor MMIO Stale Data Vulnerabilities
Windows Server 2022 Azure Edition Core Hotpatch (KB5014677) OS Build 20348.770
Microsoft Critical and Important Vulnerability Highlights
Microsoft Last But Not Least
Adobe Security Bulletins and Advisories
About Qualys Patch Tuesday
Discover and Prioritize Vulnerabilities in Vulnerability Management Detection Response (VMDR)
Rapid Response With Patch Management (PM)
Qualys Monthly Webinar Series
Join the webinar This Month in Vulnerabilities & Patches
## Microsoft Patch Tuesday Summary
Microsoft has fixed 55 vulnerabilities (aka flaws) in the June
Qualys
June 2022 Patch Tuesday | Microsoft Releases 55 Vulnerabilities With 3 Critical; Adobe Releases 6 Advisories, 46 Vulnerabilities With 40 Critical. | Qualys
blogs_qualys·2022-06-14·CVSS 7.8
[HIGH] June 2022 Patch Tuesday | Microsoft Releases 55 Vulnerabilities With 3 Critical; Adobe Releases 6 Advisories, 46 Vulnerabilities With 40 Critical. | Qualys
#### Table of Contents
- Microsoft Patch Tuesday Summary
- The June 2022 Microsoft Vulnerabilities Are Classified As Follows:
- Notable Microsoft Vulnerabilities Patched
- Microsoft Guidance on Intel Processor MMIO Stale Data Vulnerabilities
- Windows Server 2022 Azure Edition Core Hotpatch (KB5014677) OS Build 20348.770
- Microsoft Critical and Important Vulnerability Highlights
- Microsoft Last But Not Least
- Adobe Security Bulletins and Advisories
- About Qualys Patch Tuesday
- Discover and Prioritize Vulnerabilities in Vulnerability Management Detection Response (VMDR)
- Rapid Response With Patch Management (PM)
- Qualys Monthly Webinar Series
- Join the webinar This Month in Vulnerabilities & Patches
## Microsoft Patch Tuesday Summary
Microsoft has fixed 55 vulnerabilities (aka fl
https://chromereleases.googleblog.com/2022/06/stable-channel-update-for-desktop.htmlhttps://crbug.com/1330379https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/T4NMJURTG5RO3TGD7ZMIQ6Z4ZZ3SAVYE/https://security.gentoo.org/glsa/202208-25https://chromereleases.googleblog.com/2022/06/stable-channel-update-for-desktop.htmlhttps://crbug.com/1330379https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/T4NMJURTG5RO3TGD7ZMIQ6Z4ZZ3SAVYE/https://security.gentoo.org/glsa/202208-25
2022-07-28
Published