CVE-2022-2590
published 2022-08-31CVE-2022-2590: A race condition was found in the way the Linux kernel's memory subsystem handled the copy-on-write (COW) breakage of private read-only shared memory mappings…
PriorityP434high7CVSS 3.1
AVLACHPRLUINSUCHIHAH
EPSS
0.90%
56.2th percentile
A race condition was found in the way the Linux kernel's memory subsystem handled the copy-on-write (COW) breakage of private read-only shared memory mappings. This flaw allows an unprivileged, local user to gain write access to read-only memory mappings, increasing their privileges on the system.
Affected
11 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 5.18.16-1 (bookworm) | linux 5.18.16-1 (bookworm) |
| debian | linux | < linux 6.0.2-1 (bookworm) | linux 6.0.2-1 (bookworm) |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | >= 0 < 6.0.2-1 | 6.0.2-1 |
| linux | linux_kernel | >= 0 < 5.18.16-1 | 5.18.16-1 |
| linux | linux_kernel | >= 0 < 6.0.2-1 | 6.0.2-1 |
| linux | linux_kernel | >= 0 < 5.18.16-1 | 5.18.16-1 |
| linux | linux_kernel | >= 0 < 6.0.2-1 | 6.0.2-1 |
| linux | linux_kernel | >= 0 < 5.18.16-1 | 5.18.16-1 |
| linux | linux_kernel | >= 5.16 < 5.19.6 | 5.19.6 |
CVSS provenance
nvdv3.17.0HIGHCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
osv7.0HIGH
cisa9.8CRITICAL
vendor_debian7.0HIGH
vendor_redhat7.0HIGH
vendor_ubuntu7.0HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-66cr-wxhm-p423: In the Linux kernel, the following vulnerability has been resolved:
mm/gup: fix FOLL_FORCE COW security issue and remove FOLL_COW
Ever since the Dir
ghsa_unreviewed·2025-06-18·CVSS 7.0
CVE-2022-50014 [HIGH] CWE-362 GHSA-66cr-wxhm-p423: In the Linux kernel, the following vulnerability has been resolved:
mm/gup: fix FOLL_FORCE COW security issue and remove FOLL_COW
Ever since the Dir
In the Linux kernel, the following vulnerability has been resolved:
mm/gup: fix FOLL_FORCE COW security issue and remove FOLL_COW
Ever since the Dirty COW (CVE-2016-5195) security issue happened, we know
that FOLL_FORCE can be possibly dangerous, especially if there are races
that can be exploited by user space.
Right now, it would be sufficient to have some code that sets a PTE of a
R/O-mapped shared page dirty, in order for it to erroneously become
writable by FOLL_FORCE. The implications of setting a write-protected PTE
dirty might not be immediately obvious to everyone.
And in fact ever since commit 9ae0f87d009c ("mm/shmem: unconditionally set
pte dirty in mfill_atomic_install_pte"), we can use UFFDIO_CONTINUE to map
a shmem page R/O while marking the pte dirty. This can be used by
OSV
CVE-2022-50014: In the Linux kernel, the following vulnerability has been resolved: mm/gup: fix FOLL_FORCE COW security issue and remove FOLL_COW Ever since the Dirty
osv·2025-06-18·CVSS 7.0
CVE-2022-50014 [HIGH] CVE-2022-50014: In the Linux kernel, the following vulnerability has been resolved: mm/gup: fix FOLL_FORCE COW security issue and remove FOLL_COW Ever since the Dirty
In the Linux kernel, the following vulnerability has been resolved: mm/gup: fix FOLL_FORCE COW security issue and remove FOLL_COW Ever since the Dirty COW (CVE-2016-5195) security issue happened, we know that FOLL_FORCE can be possibly dangerous, especially if there are races that can be exploited by user space. Right now, it would be sufficient to have some code that sets a PTE of a R/O-mapped shared page dirty, in order for it to erroneously become writable by FOLL_FORCE. The implications of setting a write-protected PTE dirty might not be immediately obvious to everyone. And in fact ever since commit 9ae0f87d009c ("mm/shmem: unconditionally set pte dirty in mfill_atomic_install_pte"), we can use UFFDIO_CONTINUE to map a shmem page R/O while marking the pte dirty. This can be used by unp
OSV
linux-oem-5.17 vulnerabilities
osv·2023-05-10·CVSS 7.0
CVE-2023-1829 [HIGH] linux-oem-5.17 vulnerabilities
linux-oem-5.17 vulnerabilities
It was discovered that the Traffic-Control Index (TCINDEX) implementation
in the Linux kernel did not properly perform filter deactivation in some
situations. A local attacker could possibly use this to gain elevated
privileges. Please note that with the fix for this CVE, kernel support for
the TCINDEX classifier has been removed. (CVE-2023-1829)
Lin Ma discovered a race condition in the io_uring subsystem in the Linux
kernel, leading to a null pointer dereference vulnerability. A local
attacker could use this to cause a denial of service (system crash).
(CVE-2023-0468)
It was discovered that the OverlayFS implementation in the Linux kernel did
not properly handle copy up operation in some conditions. A local attacker
could possibly use this to gain elevat
GHSA
GHSA-2mhv-543f-h64j: A race condition was found in the way the Linux kernel's memory subsystem handled the copy-on-write (COW) breakage of private read-only shared memory
ghsa_unreviewed·2022-09-01
CVE-2022-2590 [HIGH] CWE-362 GHSA-2mhv-543f-h64j: A race condition was found in the way the Linux kernel's memory subsystem handled the copy-on-write (COW) breakage of private read-only shared memory
A race condition was found in the way the Linux kernel's memory subsystem handled the copy-on-write (COW) breakage of private read-only shared memory mappings. This flaw allows an unprivileged, local user to gain write access to read-only memory mappings, increasing their privileges on the system.
OSV
CVE-2022-2590: A race condition was found in the way the Linux kernel's memory subsystem handled the copy-on-write (COW) breakage of private read-only shared memory
osv·2022-08-31·CVSS 7.0
CVE-2022-2590 [HIGH] CVE-2022-2590: A race condition was found in the way the Linux kernel's memory subsystem handled the copy-on-write (COW) breakage of private read-only shared memory
A race condition was found in the way the Linux kernel's memory subsystem handled the copy-on-write (COW) breakage of private read-only shared memory mappings. This flaw allows an unprivileged, local user to gain write access to read-only memory mappings, increasing their privileges on the system.
Kernel
mm/gup: fix FOLL_FORCE COW security issue and remove FOLL_COW
kernel_security·2022-08-09·CVSS 7.0
CVE-2016-5195 [HIGH] mm/gup: fix FOLL_FORCE COW security issue and remove FOLL_COW
mm/gup: fix FOLL_FORCE COW security issue and remove FOLL_COW
Ever since the Dirty COW (CVE-2016-5195) security issue happened, we know
that FOLL_FORCE can be possibly dangerous, especially if there are races
that can be exploited by user space.
Right now, it would be sufficient to have some code that sets a PTE of a
R/O-mapped shared page dirty, in order for it to erroneously become
writable by FOLL_FORCE. The implications of setting a write-protected PTE
dirty might not be immediately obvious to everyone.
And in fact ever since commit 9ae0f87d009c ("mm/shmem: unconditionally set
pte dirty in mfill_atomic_install_pte"), we can use UFFDIO_CONTINUE to map
a shmem page R/O while marking the pte dirty. This can be used by
unprivileged user space to modify tmpfs/shmem file content even if t
Red Hat
kernel: mm/gup: fix FOLL_FORCE COW security issue and remove FOLL_COW
vendor_redhat·2025-06-18·CVSS 7.0
CVE-2022-50014 [HIGH] CWE-284 kernel: mm/gup: fix FOLL_FORCE COW security issue and remove FOLL_COW
kernel: mm/gup: fix FOLL_FORCE COW security issue and remove FOLL_COW
In the Linux kernel, the following vulnerability has been resolved:
mm/gup: fix FOLL_FORCE COW security issue and remove FOLL_COW
Ever since the Dirty COW (CVE-2016-5195) security issue happened, we know
that FOLL_FORCE can be possibly dangerous, especially if there are races
that can be exploited by user space.
Right now, it would be sufficient to have some code that sets a PTE of a
R/O-mapped shared page dirty, in order for it to erroneously become
writable by FOLL_FORCE. The implications of setting a write-protected PTE
dirty might not be immediately obvious to everyone.
And in fact ever since commit 9ae0f87d009c ("mm/shmem: unconditionally set
pte dirty in mfill_atomic_install_pte"), we can use UFFDIO_CONTINUE to ma
Ubuntu
Linux kernel (OEM) vulnerabilities
vendor_ubuntu·2023-05-10·CVSS 7.0
CVE-2023-1859 [HIGH] Linux kernel (OEM) vulnerabilities
Title: Linux kernel (OEM) vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
It was discovered that the Traffic-Control Index (TCINDEX) implementation
in the Linux kernel did not properly perform filter deactivation in some
situations. A local attacker could possibly use this to gain elevated
privileges. Please note that with the fix for this CVE, kernel support for
the TCINDEX classifier has been removed. (CVE-2023-1829)
Lin Ma discovered a race condition in the io_uring subsystem in the Linux
kernel, leading to a null pointer dereference vulnerability. A local
attacker could use this to cause a denial of service (system crash).
(CVE-2023-0468)
It was discovered that the OverlayFS implementation in the Linux kernel did
not properly handle copy up operatio
Red Hat
kernel: unprivileged tampering of shmem files
vendor_redhat·2022-08-08·CVSS 7.0
CVE-2022-2590 [HIGH] CWE-362 kernel: unprivileged tampering of shmem files
kernel: unprivileged tampering of shmem files
A race condition was found in the way the Linux kernel's memory subsystem handled the copy-on-write (COW) breakage of private read-only shared memory mappings. This flaw allows an unprivileged, local user to gain write access to read-only memory mappings, increasing their privileges on the system.
A race condition was found in the way the Linux kernel's memory subsystem handled the copy-on-write (COW) breakage of private read-only shared memory mappings. This flaw allows an unprivileged, local user to gain write access to read-only memory mappings, increasing their privileges on the system.
Mitigation: Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria compris
CISA
Oracle Java SE and Java SE Embedded Remote Code Execution Vulnerability
cisa·2022-03-03·CVSS 9.8
CVE-2015-2590 [CRITICAL] Oracle Java SE and Java SE Embedded Remote Code Execution Vulnerability
Vulnerability: Oracle Java SE and Java SE Embedded Remote Code Execution Vulnerability
Affected: Oracle Java SE
An unspecified vulnerability exists within Oracle Java Runtime Environment that allows an attacker to perform remote code execution.
Required Action: Apply updates per vendor instructions.
Notes: https://nvd.nist.gov/vuln/detail/CVE-2015-2590
Remediation Due Date: 2022-03-24
Debian
CVE-2022-2590: linux - A race condition was found in the way the Linux kernel's memory subsystem handle...
vendor_debian·2022·CVSS 7.0
CVE-2022-2590 [HIGH] CVE-2022-2590: linux - A race condition was found in the way the Linux kernel's memory subsystem handle...
A race condition was found in the way the Linux kernel's memory subsystem handled the copy-on-write (COW) breakage of private read-only shared memory mappings. This flaw allows an unprivileged, local user to gain write access to read-only memory mappings, increasing their privileges on the system.
Scope: local
bookworm: resolved (fixed in 5.18.16-1)
bullseye: resolved
forky: resolved (fixed in 5.18.16-1)
sid: resolved (fixed in 5.18.16-1)
trixie: resolved (fixed in 5.18.16-1)
Debian
CVE-2022-50014: linux - In the Linux kernel, the following vulnerability has been resolved: mm/gup: fix...
vendor_debian·2022·CVSS 7.0
CVE-2022-50014 [HIGH] CVE-2022-50014: linux - In the Linux kernel, the following vulnerability has been resolved: mm/gup: fix...
In the Linux kernel, the following vulnerability has been resolved: mm/gup: fix FOLL_FORCE COW security issue and remove FOLL_COW Ever since the Dirty COW (CVE-2016-5195) security issue happened, we know that FOLL_FORCE can be possibly dangerous, especially if there are races that can be exploited by user space. Right now, it would be sufficient to have some code that sets a PTE of a R/O-mapped shared page dirty, in order for it to erroneously become writable by FOLL_FORCE. The implications of setting a write-protected PTE dirty might not be immediately obvious to everyone. And in fact ever since commit 9ae0f87d009c ("mm/shmem: unconditionally set pte dirty in mfill_atomic_install_pte"), we can use UFFDIO_CONTINUE to map a shmem page R/O while marking the pte dirty. This can be used by unp
No detection rules found.
No public exploits indexed.
2022-08-31
Published