CVE-2022-2639
published 2022-09-01CVE-2022-2639: An integer coercion error was found in the openvswitch kernel module. Given a sufficiently large number of actions, while copying and reserving memory for a…
high7.8CVSS 3.1
AVLACLPRLUINSUCHIHAH
An integer coercion error was found in the openvswitch kernel module. Given a sufficiently large number of actions, while copying and reserving memory for a new action of a new flow, the reserve_sfa_size() function does not return -EMSGSIZE as expected, potentially leading to an out-of-bounds write access. This flaw allows a local user to crash or potentially escalate their privileges on the system.
Affected
19 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 5.17.6-1 (bookworm) | linux 5.17.6-1 (bookworm) |
| linux | linux_kernel | — | — |
| linux | linux_kernel | >= 0 < 5.10.113-1 | 5.10.113-1 |
| linux | linux_kernel | >= 0 < 5.17.6-1 | 5.17.6-1 |
| linux | linux_kernel | >= 0 < 5.17.6-1 | 5.17.6-1 |
| linux | linux_kernel | >= 0 < 5.17.6-1 | 5.17.6-1 |
| linux | linux_kernel | >= 0 < 4.4.0-234.268 | 4.4.0-234.268 |
| linux | linux_kernel | >= 3.18.139 < 3.19 | 3.19 |
| linux | linux_kernel | >= 4.14.112 < 4.14.277 | 4.14.277 |
| linux | linux_kernel | >= 4.19.35 < 4.19.240 | 4.19.240 |
| linux | linux_kernel | >= 4.4.179 < 4.5 | 4.5 |
| linux | linux_kernel | >= 4.9.169 < 4.9.312 | 4.9.312 |
| linux | linux_kernel | >= 5.0.8 < 5.4.191 | 5.4.191 |
| linux | linux_kernel | >= 5.11 < 5.15.36 | 5.15.36 |
| linux | linux_kernel | >= 5.16 < 5.17.5 | 5.17.5 |
| linux | linux_kernel | >= 5.5 < 5.10.113 | 5.10.113 |
| paloalto | pan-os | — | — |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
CVSS provenance
nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
osv7.8HIGH
Palo Alto
PAN-SA-2024-0001 Informational Bulletin: Impact of OSS CVEs in PAN-OS
vendor_paloalto·2024-02-14·CVSS 9.8
CVE-2017-18342 [CRITICAL] PAN-SA-2024-0001 Informational Bulletin: Impact of OSS CVEs in PAN-OS
PAN-SA-2024-0001 Informational Bulletin: Impact of OSS CVEs in PAN-OS
The Palo Alto Networks Product Security Assurance team has evaluated the following open source software (OSS) CVEs as they relate to PAN-OS software. While PAN-OS software may include the
CVEs: CVE-2017-18342, CVE-2017-8923, CVE-2017-9120, CVE-2019-1551, CVE-2019-16865, CVE-2019-16905, CVE-2019-19523, CVE-2019-19528, CVE-2019-19911, CVE-2020-0404, CVE-2020-0431, CVE-2020-0466, CVE-2020-10379, CVE-2020-11538, CVE-2020-11608, CVE-2020-12114, CVE-2020-12321, CVE-2020-12362, CVE-2020-12363, CVE-2020-12364, CVE-2020-13757, CVE-2020-14314, CVE-2020-14351, CVE-2020-15778, CVE-2020-1967, CVE-2020-24394, CVE-2020-24504, CVE-2020-25211, CVE-2020-25212, CVE-2020-25284, CVE-2020-25285, CVE-2020-25717, CVE-2020-26541, CVE-2020-2715
CISA ICS
Siemens SCALANCE, RUGGEDCOM Third-Party
cisa_ics·2023-03-16
Siemens SCALANCE, RUGGEDCOM Third-Party
ICS Advisory
##
Siemens SCALANCE, RUGGEDCOM Third-Party
Release DateMarch 16, 2023
Alert CodeICSA-23-075-01
As of January 10, 2023, CISA will no longer be updating ICS security advisories for Siemens product vulnerabilities beyond the initial advisory. For the most up-to-date information on vulnerabilities in this advisory, please see Siemens' ProductCERT Security Advisories (CERT Services | Services | Siemens Global).
## 1. EXECUTIVE SUMMARY
- CVSS v3 9.8
- ATTENTION: Exploitable remotely/Low attack complexity
- Vendor: Siemens
- Equipment: Busybox Applet affecting SCALANCE and RUGGEDCOM products
- Vulnerabilities: Out-of-bounds Write, Exposure of Sensitive Information to an Unauthorized Actor, Improper Locking, Improper Input Validation, NULL Pointer Deref
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2022-09-30·CVSS 6.7
CVE-2021-4037 [MEDIUM] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
It was discovered that the framebuffer driver on the Linux kernel did not
verify size limits when changing font or screen size, leading to an out-of-
bounds write. A local attacker could use this to cause a denial of service
(system crash) or possibly execute arbitrary code. (CVE-2021-33655)
It was discovered that the virtual terminal driver in the Linux kernel did
not properly handle VGA console font changes, leading to an out-of-bounds
write. A local attacker could use this to cause a denial of service (system
crash) or possibly execute arbitrary code. (CVE-2021-33656)
Christian Brauner discovered that the XFS file system implementation in the
Linux kernel did not properly handle setg
Red Hat
kernel: openvswitch: integer underflow leads to out-of-bounds write in reserve_sfa_size()
vendor_redhat·2022-04-15·CVSS 7.8
CVE-2022-2639 [HIGH] CWE-681 kernel: openvswitch: integer underflow leads to out-of-bounds write in reserve_sfa_size()
kernel: openvswitch: integer underflow leads to out-of-bounds write in reserve_sfa_size()
An integer coercion error was found in the openvswitch kernel module. Given a sufficiently large number of actions, while copying and reserving memory for a new action of a new flow, the reserve_sfa_size() function does not return -EMSGSIZE as expected, potentially leading to an out-of-bounds write access. This flaw allows a local user to crash or potentially escalate their privileges on the system.
An integer coercion error was found in the openvswitch kernel module. Given a sufficiently large number of actions, while copying and reserving memory for a new action of a new flow, the reserve_sfa_size() function does not return -EMSGSIZE as expected, potentially leading to an out-of-bounds write acces
Debian
CVE-2022-2639: linux - An integer coercion error was found in the openvswitch kernel module. Given a su...
vendor_debian·2022·CVSS 7.8
CVE-2022-2639 [HIGH] CVE-2022-2639: linux - An integer coercion error was found in the openvswitch kernel module. Given a su...
An integer coercion error was found in the openvswitch kernel module. Given a sufficiently large number of actions, while copying and reserving memory for a new action of a new flow, the reserve_sfa_size() function does not return -EMSGSIZE as expected, potentially leading to an out-of-bounds write access. This flaw allows a local user to crash or potentially escalate their privileges on the system.
Scope: local
bookworm: resolved (fixed in 5.17.6-1)
bullseye: resolved (fixed in 5.10.113-1)
forky: resolved (fixed in 5.17.6-1)
sid: resolved (fixed in 5.17.6-1)
trixie: resolved (fixed in 5.17.6-1)
OSV
linux, linux-aws, linux-kvm, linux-lts-xenial vulnerabilities
osv·2022-09-30·CVSS 6.7
CVE-2021-33655 [MEDIUM] linux, linux-aws, linux-kvm, linux-lts-xenial vulnerabilities
linux, linux-aws, linux-kvm, linux-lts-xenial vulnerabilities
It was discovered that the framebuffer driver on the Linux kernel did not
verify size limits when changing font or screen size, leading to an out-of-
bounds write. A local attacker could use this to cause a denial of service
(system crash) or possibly execute arbitrary code. (CVE-2021-33655)
It was discovered that the virtual terminal driver in the Linux kernel did
not properly handle VGA console font changes, leading to an out-of-bounds
write. A local attacker could use this to cause a denial of service (system
crash) or possibly execute arbitrary code. (CVE-2021-33656)
Christian Brauner discovered that the XFS file system implementation in the
Linux kernel did not properly handle setgid file creation. A local attacker
could
GHSA
GHSA-w6wh-qr7x-h932: An integer coercion error was found in the openvswitch kernel module
ghsa_unreviewed·2022-09-02
CVE-2022-2639 [HIGH] CWE-192 GHSA-w6wh-qr7x-h932: An integer coercion error was found in the openvswitch kernel module
An integer coercion error was found in the openvswitch kernel module. Given a sufficiently large number of actions, while copying and reserving memory for a new action of a new flow, the reserve_sfa_size() function does not return -EMSGSIZE as expected, potentially leading to an out-of-bounds write access. This flaw allows a local user to crash or potentially escalate their privileges on the system.
OSV
CVE-2022-2639: An integer coercion error was found in the openvswitch kernel module
osv·2022-09-01·CVSS 7.8
CVE-2022-2639 [HIGH] CVE-2022-2639: An integer coercion error was found in the openvswitch kernel module
An integer coercion error was found in the openvswitch kernel module. Given a sufficiently large number of actions, while copying and reserving memory for a new action of a new flow, the reserve_sfa_size() function does not return -EMSGSIZE as expected, potentially leading to an out-of-bounds write access. This flaw allows a local user to crash or potentially escalate their privileges on the system.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
CWE
Integer Coercion Error
mitre_cwe
CWE-192 Integer Coercion Error
CWE-192: Integer Coercion Error
Integer coercion refers to a set of flaws pertaining to the type casting, extension, or truncation of primitive data types.
Several flaws fall under the category of integer coercion errors. For the most part, these errors in and of themselves result only in availability and data integrity issues. However, in some circumstances, they may result in other, more complicated security related flaws, such as buffer overflow conditions.
Modes of Introduction:
Phase: Implementation
Common Consequences:
Scope: Availability. Impact: DoS: Resource Consumption (CPU), DoS: Resource Consumption (Memory), DoS: Crash, Exit, or Restart. Integer coercion often leads to undefined states of execution resulting in infinite loops or crashes.
Scope: Integrity, Confidentiality,
CWE
Incorrect Conversion between Numeric Types
mitre_cwe
CWE-681 Incorrect Conversion between Numeric Types
CWE-681: Incorrect Conversion between Numeric Types
When converting from one data type to another, such as long to integer, data can be omitted or translated in a way that produces unexpected values. If the resulting values are used in a sensitive context, then dangerous behaviors may occur.
Modes of Introduction:
Phase: Implementation
Common Consequences:
Scope: Other, Integrity. Impact: Unexpected State, Quality Degradation. The program could wind up using the wrong number and generate incorrect results. If the number is used to allocate resources or make a security decision, then this could introduce a vulnerability.
Detection Methods:
Automated Static Analysis: Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of
2022-09-01
Published