CVE-2022-2585
published 2024-01-08CVE-2022-2585: It was discovered that when exec'ing from a non-leader thread, armed POSIX CPU timers would be left on a list but freed, leading to a use-after-free.
PriorityP339high7.8CVSS 3.1
AVLACLPRLUINSUCHIHAH
EPSS
1.28%
66.9th percentile
It was discovered that when exec'ing from a non-leader thread, armed POSIX CPU timers would be left on a list but freed, leading to a use-after-free.
Affected
19 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| debian | linux | < linux 5.18.16-1 (bookworm) | linux 5.18.16-1 (bookworm) |
| linux | linux_kernel | >= 0 < 5.10.136-1 | 5.10.136-1 |
| linux | linux_kernel | >= 0 < 5.18.16-1 | 5.18.16-1 |
| linux | linux_kernel | >= 0 < 5.18.16-1 | 5.18.16-1 |
| linux | linux_kernel | >= 0 < 5.18.16-1 | 5.18.16-1 |
| linux | linux_kernel | >= 0 < 5.15.0-46.49 | 5.15.0-46.49 |
| linux | linux_kernel | >= 0 < 4.4.0-231.265 | 4.4.0-231.265 |
| linux | linux_kernel | >= 0 < 4.15.0-191.202 | 4.15.0-191.202 |
| linux | linux_kernel | >= 0 < 5.4.0-124.140 | 5.4.0-124.140 |
| linux | linux_kernel | >= 0 < 5.15.0-46.49 | 5.15.0-46.49 |
| linux | linux_kernel | >= 5.11 < 5.15.61 | 5.15.61 |
| linux | linux_kernel | >= 5.16 < 5.18.18 | 5.18.18 |
| linux | linux_kernel | >= 5.19 < 5.19.2 | 5.19.2 |
| linux | linux_kernel | >= 5.7 < 5.10.137 | 5.10.137 |
| msrc | cbl2_kernel_5.15.153.1-1_on_cbl_mariner_2.0 | — | — |
| msrc | cbl2_kernel_5.15.162.2-1_on_cbl_mariner_2.0 | — | — |
| the_linux_kernel_organization | linux | < 6.0~rc1 | 6.0~rc1 |
CVSS provenance
nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
osv7.8HIGH
vendor_msrc7.8HIGH
vendor_ubuntu7.8HIGH
vendor_debian5.3MEDIUM
vendor_redhat5.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Microsoft
It was discovered that when exec'ing from a non-leader thread armed POSIX CPU timers would be left on a list but freed leading to a use-after-free.
vendor_msrc·2024-01-09·CVSS 7.8
CVE-2022-2585 [MEDIUM] CWE-416 It was discovered that when exec'ing from a non-leader thread armed POSIX CPU timers would be left on a list but freed leading to a use-after-free.
It was discovered that when exec'ing from a non-leader thread armed POSIX CPU timers would be left on a list but freed leading to a use-after-free.
FAQ: Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability?
One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source libraries with which the distro is composed. Microsoft is committed to transparency in this work which is why we began publishing CSAF/VEX in October 2025. See this blog post for more information. If impact to additional products is identified, we will update the CVE to reflect this.
Mariner: Mariner
canonical: c
CISA ICS
Siemens SIMATIC S7-1500 TM MFP BIOS
cisa_ics·2023-06-15·CVSS 5.9
[MEDIUM] Siemens SIMATIC S7-1500 TM MFP BIOS
ICS Advisory
##
Siemens SIMATIC S7-1500 TM MFP BIOS
Release DateJune 15, 2023
Alert CodeICSA-23-166-10
## As of January 10, 2023, CISA will no longer be updating ICS security advisories for Siemens product vulnerabilities beyond the initial advisory. For the most up-to-date information on vulnerabilities in this advisory, please see Siemens' ProductCERT Security Advisories (CERT Services | Services | Siemens Global).
## 1. EXECUTIVE SUMMARY
- CVSS v3 9.8
- ATTENTION: Exploitable remotely / low attack complexity
- Vendor: Siemens
- Equipment: SIMATIC S7-1500 TM MFP
- Vulnerabilities: Improper Input Validation, Out-of-bounds Read, Use After Free, Out-of-bounds Write, Infinite Loop, Reachable Assertion, Off-by-one Error, Incorrect Default Permissions, Double Fr
Ubuntu
Kernel Live Patch Security Notice
vendor_ubuntu·2022-08-24·CVSS 6.7
CVE-2022-2586 [MEDIUM] Kernel Live Patch Security Notice
Title: Kernel Live Patch Security Notice
Summary: Several security issues were fixed in the kernel.
Aaron Adams discovered that the netfilter subsystem in the Linux kernel did not properly handle the removal of stateful expressions in some situations, leading to a use-after-free vulnerability. A local attacker could use this to cause a denial of service (system crash) or execute arbitrary code. (CVE-2022-1966)
Ziming Zhang discovered that the netfilter subsystem in the Linux kernel
did not properly validate sets with multiple ranged fields. A local
attacker could use this to cause a denial of service or execute arbitrary
code.(CVE-2022-1972)
It was discovered that the implementation of POSIX timers in the Linux
kernel did not properly clean up timers in some situations. A local
attacke
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2022-08-10·CVSS 5.3
CVE-2022-2588 [MEDIUM] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
Zhenpeng Lin discovered that the network packet scheduler implementation in
the Linux kernel did not properly remove all references to a route filter
before freeing it in some situations. A local attacker could use this to
cause a denial of service (system crash) or execute arbitrary code.
(CVE-2022-2588)
It was discovered that the netfilter subsystem of the Linux kernel did not
prevent one nft object from referencing an nft set in another nft table,
leading to a use-after-free vulnerability. A local attacker could use this
to cause a denial of service (system crash) or execute arbitrary code.
(CVE-2022-2586)
It was discovered that the implementation of POSIX timers in the Linux
kernel
Ubuntu
Linux kernel (Intel IoTG) vulnerabilities
vendor_ubuntu·2022-08-10·CVSS 7.8
CVE-2022-1734 [HIGH] Linux kernel (Intel IoTG) vulnerabilities
Title: Linux kernel (Intel IoTG) vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
Zhenpeng Lin discovered that the network packet scheduler implementation in
the Linux kernel did not properly remove all references to a route filter
before freeing it in some situations. A local attacker could use this to
cause a denial of service (system crash) or execute arbitrary code.
(CVE-2022-2588)
It was discovered that the netfilter subsystem of the Linux kernel did not
prevent one nft object from referencing an nft set in another nft table,
leading to a use-after-free vulnerability. A local attacker could use this
to cause a denial of service (system crash) or execute arbitrary code.
(CVE-2022-2586)
It was discovered that the implementation of POSIX timers in the
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2022-08-10·CVSS 7.8
CVE-2022-2586 [HIGH] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
Zhenpeng Lin discovered that the network packet scheduler implementation in
the Linux kernel did not properly remove all references to a route filter
before freeing it in some situations. A local attacker could use this to
cause a denial of service (system crash) or execute arbitrary code.
(CVE-2022-2588)
It was discovered that the netfilter subsystem of the Linux kernel did not
prevent one nft object from referencing an nft set in another nft table,
leading to a use-after-free vulnerability. A local attacker could use this
to cause a denial of service (system crash) or execute arbitrary code.
(CVE-2022-2586)
It was discovered that the implementation of POSIX timers in the Linux
kernel
Ubuntu
Linux kernel (OEM) vulnerabilities
vendor_ubuntu·2022-08-10·CVSS 5.3
CVE-2022-2588 [MEDIUM] Linux kernel (OEM) vulnerabilities
Title: Linux kernel (OEM) vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
Zhenpeng Lin discovered that the network packet scheduler implementation in
the Linux kernel did not properly remove all references to a route filter
before freeing it in some situations. A local attacker could use this to
cause a denial of service (system crash) or execute arbitrary code.
(CVE-2022-2588)
It was discovered that the netfilter subsystem of the Linux kernel did not
prevent one nft object from referencing an nft set in another nft table,
leading to a use-after-free vulnerability. A local attacker could use this
to cause a denial of service (system crash) or execute arbitrary code.
(CVE-2022-2586)
It was discovered that the implementation of POSIX timers in the Linux
k
Red Hat
kernel: posix cpu timer use-after-free may lead to local privilege escalation
vendor_redhat·2022-08-09·CVSS 5.3
CVE-2022-2585 [MEDIUM] CWE-416 kernel: posix cpu timer use-after-free may lead to local privilege escalation
kernel: posix cpu timer use-after-free may lead to local privilege escalation
It was discovered that when exec'ing from a non-leader thread, armed POSIX CPU timers would be left on a list but freed, leading to a use-after-free.
A use-after-free flaw was found in the Linux kernel’s POSIX CPU timers functionality in the way a user creates and then deletes the timer in the non-leader thread of the program. This flaw allows a local user to crash or potentially escalate their privileges on the system.
Mitigation: Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Package: kernel (Red Hat Enterprise Linux 6) - N
Debian
CVE-2022-2585: linux - It was discovered that when exec'ing from a non-leader thread, armed POSIX CPU t...
vendor_debian·2022·CVSS 5.3
CVE-2022-2585 [MEDIUM] CVE-2022-2585: linux - It was discovered that when exec'ing from a non-leader thread, armed POSIX CPU t...
It was discovered that when exec'ing from a non-leader thread, armed POSIX CPU timers would be left on a list but freed, leading to a use-after-free.
Scope: local
bookworm: resolved (fixed in 5.18.16-1)
bullseye: resolved (fixed in 5.10.136-1)
forky: resolved (fixed in 5.18.16-1)
sid: resolved (fixed in 5.18.16-1)
trixie: resolved (fixed in 5.18.16-1)
OSV
CVE-2022-2585: It was discovered that when exec'ing from a non-leader thread, armed POSIX CPU timers would be left on a list but freed, leading to a use-after-free
osv·2024-01-08·CVSS 7.8
CVE-2022-2585 [HIGH] CVE-2022-2585: It was discovered that when exec'ing from a non-leader thread, armed POSIX CPU timers would be left on a list but freed, leading to a use-after-free
It was discovered that when exec'ing from a non-leader thread, armed POSIX CPU timers would be left on a list but freed, leading to a use-after-free.
OSV
Kernel Live Patch Security Notice
osv·2022-08-24·CVSS 7.8
CVE-2022-1966 [HIGH] Kernel Live Patch Security Notice
Kernel Live Patch Security Notice
Aaron Adams discovered that the netfilter subsystem in the Linux kernel did not properly handle the removal of stateful expressions in some situations, leading to a use-after-free vulnerability. A local attacker could use this to cause a denial of service (system crash) or execute arbitrary code. (CVE-2022-1966)
Ziming Zhang discovered that the netfilter subsystem in the Linux kernel
did not properly validate sets with multiple ranged fields. A local
attacker could use this to cause a denial of service or execute arbitrary
code.(CVE-2022-1972)
It was discovered that the implementation of POSIX timers in the Linux
kernel did not properly clean up timers in some situations. A local
attacker could use this to cause a denial of service (system crash) or
exe
OSV
linux-aws, linux-aws-5.15, linux-azure, linux-azure-5.15, linux-gcp, linux-gcp-5.15, linux-gke, linux-gke-5.15, linux-ibm, linux-kvm, linux-oracle, linux-raspi vulnerabilities
osv·2022-08-10·CVSS 7.8
CVE-2022-2588 [HIGH] linux-aws, linux-aws-5.15, linux-azure, linux-azure-5.15, linux-gcp, linux-gcp-5.15, linux-gke, linux-gke-5.15, linux-ibm, linux-kvm, linux-oracle, linux-raspi vulnerabilities
linux-aws, linux-aws-5.15, linux-azure, linux-azure-5.15, linux-gcp, linux-gcp-5.15, linux-gke, linux-gke-5.15, linux-ibm, linux-kvm, linux-oracle, linux-raspi vulnerabilities
Zhenpeng Lin discovered that the network packet scheduler implementation in
the Linux kernel did not properly remove all references to a route filter
before freeing it in some situations. A local attacker could use this to
cause a denial of service (system crash) or execute arbitrary code.
(CVE-2022-2588)
It was discovered that the netfilter subsystem of the Linux kernel did not
prevent one nft object from referencing an nft set in another nft table,
leading to a use-after-free vulnerability. A local attacker could use this
to cause a denial of service (system crash) or execute arbitrary code.
(CVE-2022-2586)
It w
OSV
linux-oem-5.14, linux-oem-5.17 vulnerabilities
osv·2022-08-10·CVSS 7.8
CVE-2022-2588 [HIGH] linux-oem-5.14, linux-oem-5.17 vulnerabilities
linux-oem-5.14, linux-oem-5.17 vulnerabilities
Zhenpeng Lin discovered that the network packet scheduler implementation in
the Linux kernel did not properly remove all references to a route filter
before freeing it in some situations. A local attacker could use this to
cause a denial of service (system crash) or execute arbitrary code.
(CVE-2022-2588)
It was discovered that the netfilter subsystem of the Linux kernel did not
prevent one nft object from referencing an nft set in another nft table,
leading to a use-after-free vulnerability. A local attacker could use this
to cause a denial of service (system crash) or execute arbitrary code.
(CVE-2022-2586)
It was discovered that the implementation of POSIX timers in the Linux
kernel did not properly clean up timers in some situations. A
OSV
linux-intel-iotg vulnerabilities
osv·2022-08-10·CVSS 7.8
CVE-2022-2588 [HIGH] linux-intel-iotg vulnerabilities
linux-intel-iotg vulnerabilities
Zhenpeng Lin discovered that the network packet scheduler implementation in
the Linux kernel did not properly remove all references to a route filter
before freeing it in some situations. A local attacker could use this to
cause a denial of service (system crash) or execute arbitrary code.
(CVE-2022-2588)
It was discovered that the netfilter subsystem of the Linux kernel did not
prevent one nft object from referencing an nft set in another nft table,
leading to a use-after-free vulnerability. A local attacker could use this
to cause a denial of service (system crash) or execute arbitrary code.
(CVE-2022-2586)
It was discovered that the implementation of POSIX timers in the Linux
kernel did not properly clean up timers in some situations. A local
attacker
OSV
linux, linux-hwe-5.15, linux-lowlatency, linux-lowlatency-hwe-5.15 vulnerabilities
osv·2022-08-10·CVSS 7.8
CVE-2022-2588 [HIGH] linux, linux-hwe-5.15, linux-lowlatency, linux-lowlatency-hwe-5.15 vulnerabilities
linux, linux-hwe-5.15, linux-lowlatency, linux-lowlatency-hwe-5.15 vulnerabilities
Zhenpeng Lin discovered that the network packet scheduler implementation in
the Linux kernel did not properly remove all references to a route filter
before freeing it in some situations. A local attacker could use this to
cause a denial of service (system crash) or execute arbitrary code.
(CVE-2022-2588)
It was discovered that the netfilter subsystem of the Linux kernel did not
prevent one nft object from referencing an nft set in another nft table,
leading to a use-after-free vulnerability. A local attacker could use this
to cause a denial of service (system crash) or execute arbitrary code.
(CVE-2022-2586)
It was discovered that the implementation of POSIX timers in the Linux
kernel did not properly cl
No detection rules found.
No public exploits indexed.
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-2585https://lore.kernel.org/lkml/[email protected]/T/#uhttps://ubuntu.com/security/notices/USN-5564-1https://ubuntu.com/security/notices/USN-5565-1https://ubuntu.com/security/notices/USN-5566-1https://ubuntu.com/security/notices/USN-5567-1https://www.openwall.com/lists/oss-security/2022/08/09/7https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-2585https://lore.kernel.org/lkml/[email protected]/T/#uhttps://ubuntu.com/security/notices/USN-5564-1https://ubuntu.com/security/notices/USN-5565-1https://ubuntu.com/security/notices/USN-5566-1https://ubuntu.com/security/notices/USN-5567-1https://www.openwall.com/lists/oss-security/2022/08/09/7
2024-01-08
Published