CVE-2022-20368
published 2022-08-11CVE-2022-20368: Product: AndroidVersions: Android kernelAndroid ID: A-224546354References: Upstream kernel
PriorityP336high7.8CVSS 3.1
AVLACLPRLUINSUCHIHAH
EPSS
0.13%
2.9th percentile
Product: AndroidVersions: Android kernelAndroid ID: A-224546354References: Upstream kernel
Affected
7 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 5.16.18-1 (bookworm) | linux 5.16.18-1 (bookworm) |
| linux | linux_kernel | >= 0 < 5.10.113-1 | 5.10.113-1 |
| linux | linux_kernel | >= 0 < 5.16.18-1 | 5.16.18-1 |
| linux | linux_kernel | >= 0 < 5.16.18-1 | 5.16.18-1 |
| linux | linux_kernel | >= 0 < 5.16.18-1 | 5.16.18-1 |
| linux | linux_kernel | >= 0 < 4.4.0-234.268 | 4.4.0-234.268 |
| paloalto | pan-os | — | — |
CVSS provenance
nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
osv7.8HIGH
vendor_debian7.8HIGH
vendor_redhat7.8HIGH
vendor_ubuntu6.7MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
linux, linux-aws, linux-kvm, linux-lts-xenial vulnerabilities
osv·2022-09-30·CVSS 6.7
CVE-2021-33655 [MEDIUM] linux, linux-aws, linux-kvm, linux-lts-xenial vulnerabilities
linux, linux-aws, linux-kvm, linux-lts-xenial vulnerabilities
It was discovered that the framebuffer driver on the Linux kernel did not
verify size limits when changing font or screen size, leading to an out-of-
bounds write. A local attacker could use this to cause a denial of service
(system crash) or possibly execute arbitrary code. (CVE-2021-33655)
It was discovered that the virtual terminal driver in the Linux kernel did
not properly handle VGA console font changes, leading to an out-of-bounds
write. A local attacker could use this to cause a denial of service (system
crash) or possibly execute arbitrary code. (CVE-2021-33656)
Christian Brauner discovered that the XFS file system implementation in the
Linux kernel did not properly handle setgid file creation. A local attacker
could
OSV
linux-aws vulnerabilities
osv·2022-08-24·CVSS 6.7
CVE-2021-33655 [MEDIUM] linux-aws vulnerabilities
linux-aws vulnerabilities
It was discovered that the framebuffer driver on the Linux kernel did not
verify size limits when changing font or screen size, leading to an out-of-
bounds write. A local attacker could use this to cause a denial of service
(system crash) or possibly execute arbitrary code. (CVE-2021-33655)
It was discovered that the virtual terminal driver in the Linux kernel did
not properly handle VGA console font changes, leading to an out-of-bounds
write. A local attacker could use this to cause a denial of service (system
crash) or possibly execute arbitrary code. (CVE-2021-33656)
It was discovered that the Packet network protocol implementation in the
Linux kernel contained an out-of-bounds access. A remote attacker could use
this to expose sensitive information (kernel
GHSA
GHSA-4x46-943r-8cjh: Product: AndroidVersions: Android kernelAndroid ID: A-224546354References: Upstream kernel
ghsa_unreviewed·2022-08-12
CVE-2022-20368 [CRITICAL] GHSA-4x46-943r-8cjh: Product: AndroidVersions: Android kernelAndroid ID: A-224546354References: Upstream kernel
Product: AndroidVersions: Android kernelAndroid ID: A-224546354References: Upstream kernel
OSV
CVE-2022-20368: Product: AndroidVersions: Android kernelAndroid ID: A-224546354References: Upstream kernel
osv·2022-08-11·CVSS 7.8
CVE-2022-20368 [HIGH] CVE-2022-20368: Product: AndroidVersions: Android kernelAndroid ID: A-224546354References: Upstream kernel
Product: AndroidVersions: Android kernelAndroid ID: A-224546354References: Upstream kernel
Palo Alto
PAN-SA-2024-0001 Informational Bulletin: Impact of OSS CVEs in PAN-OS
vendor_paloalto·2024-02-14·CVSS 9.8
CVE-2017-18342 [CRITICAL] PAN-SA-2024-0001 Informational Bulletin: Impact of OSS CVEs in PAN-OS
PAN-SA-2024-0001 Informational Bulletin: Impact of OSS CVEs in PAN-OS
The Palo Alto Networks Product Security Assurance team has evaluated the following open source software (OSS) CVEs as they relate to PAN-OS software. While PAN-OS software may include the
CVEs: CVE-2017-18342, CVE-2017-8923, CVE-2017-9120, CVE-2019-1551, CVE-2019-16865, CVE-2019-16905, CVE-2019-19523, CVE-2019-19528, CVE-2019-19911, CVE-2020-0404, CVE-2020-0431, CVE-2020-0466, CVE-2020-10379, CVE-2020-11538, CVE-2020-11608, CVE-2020-12114, CVE-2020-12321, CVE-2020-12362, CVE-2020-12363, CVE-2020-12364, CVE-2020-13757, CVE-2020-14314, CVE-2020-14351, CVE-2020-15778, CVE-2020-1967, CVE-2020-24394, CVE-2020-24504, CVE-2020-25211, CVE-2020-25212, CVE-2020-25284, CVE-2020-25285, CVE-2020-25717, CVE-2020-26541, CVE-2020-2715
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2022-09-30·CVSS 6.7
CVE-2021-4037 [MEDIUM] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
It was discovered that the framebuffer driver on the Linux kernel did not
verify size limits when changing font or screen size, leading to an out-of-
bounds write. A local attacker could use this to cause a denial of service
(system crash) or possibly execute arbitrary code. (CVE-2021-33655)
It was discovered that the virtual terminal driver in the Linux kernel did
not properly handle VGA console font changes, leading to an out-of-bounds
write. A local attacker could use this to cause a denial of service (system
crash) or possibly execute arbitrary code. (CVE-2021-33656)
Christian Brauner discovered that the XFS file system implementation in the
Linux kernel did not properly handle setg
Ubuntu
Linux kernel (AWS) vulnerabilities
vendor_ubuntu·2022-08-24·CVSS 6.7
CVE-2022-36946 [MEDIUM] Linux kernel (AWS) vulnerabilities
Title: Linux kernel (AWS) vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
It was discovered that the framebuffer driver on the Linux kernel did not
verify size limits when changing font or screen size, leading to an out-of-
bounds write. A local attacker could use this to cause a denial of service
(system crash) or possibly execute arbitrary code. (CVE-2021-33655)
It was discovered that the virtual terminal driver in the Linux kernel did
not properly handle VGA console font changes, leading to an out-of-bounds
write. A local attacker could use this to cause a denial of service (system
crash) or possibly execute arbitrary code. (CVE-2021-33656)
It was discovered that the Packet network protocol implementation in the
Linux kernel contained an out-of-bound
Red Hat
kernel: net/packet: slab-out-of-bounds access in packet_recvmsg()
vendor_redhat·2022-03-15·CVSS 7.8
CVE-2022-20368 [HIGH] CWE-787 kernel: net/packet: slab-out-of-bounds access in packet_recvmsg()
kernel: net/packet: slab-out-of-bounds access in packet_recvmsg()
Product: AndroidVersions: Android kernelAndroid ID: A-224546354References: Upstream kernel
An out-of-bounds access issue was found in the Linux kernel networking subsystem in the way raw packet sockets (AF_PACKET) used PACKET_COPY_THRESH and mmap operations. A local attacker with CAP_NET_RAW capability could use this flaw to trigger a buffer overflow resulting in a system crash or privilege escalation.
Statement: Only local users with `CAP_NET_RAW` capability enabled can trigger this issue. On Red Hat Enterprise Linux 8 `CAP_NET_RAW` capability can be gained by exploiting unprivileged user namespaces.
In a default or common use of Red Hat Enterprise Linux 7 unprivileged user namespaces are disabled by default, so local un
Debian
CVE-2022-20368: linux - Product: AndroidVersions: Android kernelAndroid ID: A-224546354References: Upstr...
vendor_debian·2022·CVSS 7.8
CVE-2022-20368 [HIGH] CVE-2022-20368: linux - Product: AndroidVersions: Android kernelAndroid ID: A-224546354References: Upstr...
Product: AndroidVersions: Android kernelAndroid ID: A-224546354References: Upstream kernel
Scope: local
bookworm: resolved (fixed in 5.16.18-1)
bullseye: resolved (fixed in 5.10.113-1)
forky: resolved (fixed in 5.16.18-1)
sid: resolved (fixed in 5.16.18-1)
trixie: resolved (fixed in 5.16.18-1)
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2022-08-11
Published