CVE-2022-24448 — Improper Handling of Exceptional Conditions in Kernel

CWE-755 — Improper Handling of Exceptional ConditionsCWE-908 — Use of Uninitialized ResourceCWE-909 — Missing Initialization of Resource16 documents8 sources
Severity
3.3LOWNVD
OSV6.7OSV5.5OSV4.6
EPSS
0.0%
top 96.28%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
6
Linux KernelDebian LinuxDebian Linux+3 more
Timeline
PublishedFeb 4
Latest updateDec 10

Description

An issue was discovered in fs/nfs/dir.c in the Linux kernel before 5.16.5. If an application sets the O_DIRECTORY flag, and tries to open a regular file, nfs_atomic_open() performs a regular lookup. If a regular file is found, ENOTDIR should occur, but the server instead returns uninitialized data in the file descriptor.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:NExploitability: 1.8 | Impact: 1.4

Affected Packages7 packages

▶NVDlinux/linux_kernel< 5.16.5
▶Debianlinux/linux_kernel< 5.10.92-2+3
▶Ubuntulinux/linux_kernel< 4.15.0-176.185+1
▶debiandebian/linux< linux 5.16.7-1 (bookworm)

Also affects: Debian Linux 10.0, 11.0, 9.0

Patches

Patch: cdn.kernel.org ↗Patch: git.kernel.org ↗Patch: github.com ↗

🔴Vulnerability Details

6
OSV
linux, linux-aws, linux-aws-hwe, linux-azure, linux-azure-4.15, linux-dell300x, linux-gcp, inux-gcp-4.15, linux-hwe, linux-kvm, linux-oracle, linux-snapdragon vulnerabilities↗2022-04-21
▶
OSV
linux, linux-aws, linux-aws-5.4, linux-azure, linux-azure-5.4, linux-azure-fde, linux-gcp, linux-gcp-5.4, linux-gke, linux-gke-5.4, linux-gkeop, linux-gkeop-5.4, linux-hwe-5.4, linux-ibm, linux-ibm-5.↗2022-04-20
▶
OSV
linux, linux-aws, linux-aws-5.13, linux-azure, linux-azure-5.13, linux-gcp, linux-gcp-5.13, linux-hwe-5.13, linux-kvm, linux-oracle, linux-oracle-5.13, linux-raspi vulnerabilities↗2022-04-20
▶
OSV
linux-oem-5.14 vulnerabilities↗2022-02-22
▶
GHSA
GHSA-pg3v-wrvf-hgf7: An issue was discovered in fs/nfs/dir↗2022-02-10
▶

📋Vendor Advisories

9
Ubuntu
Linux kernel vulnerabilities↗2024-12-10
▶
Palo Alto
PAN-SA-2024-0001 Informational Bulletin: Impact of OSS CVEs in PAN-OS↗2024-02-14
▶
Ubuntu
Linux kernel vulnerabilities↗2022-04-21
▶
Ubuntu
Linux kernel vulnerabilities↗2022-04-20
▶
Ubuntu
Linux kernel vulnerabilities↗2022-04-20
▶