CVE-2022-2991
published 2022-08-25CVE-2022-2991: A heap-based buffer overflow was found in the Linux kernel's LightNVM subsystem. The issue results from the lack of proper validation of the length of…
PriorityP433medium6.7CVSS 3.1
AVLACLPRHUINSUCHIHAH
EPSS
0.42%
34.7th percentile
A heap-based buffer overflow was found in the Linux kernel's LightNVM subsystem. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length heap-based buffer. This vulnerability allows a local attacker to escalate privileges and execute arbitrary code in the context of the kernel. The attacker must first obtain the ability to execute high-privileged code on the target system to exploit this vulnerability.
Affected
9 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 5.15.3-1 (bookworm) | linux 5.15.3-1 (bookworm) |
| linux | linux_kernel | < 5.15 | 5.15 |
| linux | linux_kernel | — | — |
| linux | linux_kernel | >= 0 < 5.10.120-1 | 5.10.120-1 |
| linux | linux_kernel | >= 0 < 5.15.3-1 | 5.15.3-1 |
| linux | linux_kernel | >= 0 < 5.15.3-1 | 5.15.3-1 |
| linux | linux_kernel | >= 0 < 5.15.3-1 | 5.15.3-1 |
| linux | linux_kernel | >= 0 < 4.4.0-239.273 | 4.4.0-239.273 |
| msrc | cm1_kernel_5.10.145.1-1_on_cbl_mariner_1.0 | — | — |
CVSS provenance
nvdv3.16.7MEDIUMCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
osv6.7MEDIUM
vendor_debian6.7LOW
vendor_msrc6.7MEDIUM
vendor_redhat6.7MEDIUM
vendor_ubuntu5.9MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
Linux kernel (AWS) vulnerabilities
vendor_ubuntu·2023-04-12·CVSS 5.9
CVE-2022-1516 [MEDIUM] Linux kernel (AWS) vulnerabilities
Title: Linux kernel (AWS) vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
Xuewei Feng, Chuanpu Fu, Qi Li, Kun Sun, and Ke Xu discovered that the TCP
implementation in the Linux kernel did not properly handle IPID assignment.
A remote attacker could use this to cause a denial of service (connection
termination) or inject forged data. (CVE-2020-36516)
Ke Sun, Alyssa Milburn, Henrique Kawakami, Emma Benoit, Igor Chervatyuk,
Lisa Aichele, and Thais Moreira Hamasaki discovered that the Spectre
Variant 2 mitigations for AMD processors on Linux were insufficient in some
situations. A local attacker could possibly use this to expose sensitive
information. (CVE-2021-26401)
Jürgen Groß discovered that the Xen subsystem within the Linux kernel did
not adequately l
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2023-04-12·CVSS 5.9
CVE-2023-1095 [MEDIUM] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
Xuewei Feng, Chuanpu Fu, Qi Li, Kun Sun, and Ke Xu discovered that the TCP
implementation in the Linux kernel did not properly handle IPID assignment.
A remote attacker could use this to cause a denial of service (connection
termination) or inject forged data. (CVE-2020-36516)
Ke Sun, Alyssa Milburn, Henrique Kawakami, Emma Benoit, Igor Chervatyuk,
Lisa Aichele, and Thais Moreira Hamasaki discovered that the Spectre
Variant 2 mitigations for AMD processors on Linux were insufficient in some
situations. A local attacker could possibly use this to expose sensitive
information. (CVE-2021-26401)
Jürgen Groß discovered that the Xen subsystem within the Linux kernel did
not adequately limit t
Ubuntu
Linux kernel (AWS) vulnerabilities
vendor_ubuntu·2023-04-06·CVSS 5.9
CVE-2023-1095 [MEDIUM] Linux kernel (AWS) vulnerabilities
Title: Linux kernel (AWS) vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
Xuewei Feng, Chuanpu Fu, Qi Li, Kun Sun, and Ke Xu discovered that the TCP
implementation in the Linux kernel did not properly handle IPID assignment.
A remote attacker could use this to cause a denial of service (connection
termination) or inject forged data. (CVE-2020-36516)
Ke Sun, Alyssa Milburn, Henrique Kawakami, Emma Benoit, Igor Chervatyuk,
Lisa Aichele, and Thais Moreira Hamasaki discovered that the Spectre
Variant 2 mitigations for AMD processors on Linux were insufficient in some
situations. A local attacker could possibly use this to expose sensitive
information. (CVE-2021-26401)
Jürgen Groß discovered that the Xen subsystem within the Linux kernel did
not adequately l
Microsoft
A heap-based buffer overflow was found in the Linux kernel's LightNVM subsystem. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed
vendor_msrc·2022-08-09·CVSS 6.7
CVE-2022-2991 [MEDIUM] CWE-787 A heap-based buffer overflow was found in the Linux kernel's LightNVM subsystem. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed
A heap-based buffer overflow was found in the Linux kernel's LightNVM subsystem. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length heap-based buffer. This vulnerability allows a local attacker to escalate privileges and execute arbitrary code in the context of the kernel. The attacker must first obtain the ability to execute high-privileged code on the target system to exploit this vulnerability.
FAQ: Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability?
One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the
Red Hat
kernel: heap-based overflow in LightNVM Subsystem may lead to privilege escalation
vendor_redhat·2022-07-11·CVSS 6.7
CVE-2022-2991 [MEDIUM] CWE-122 kernel: heap-based overflow in LightNVM Subsystem may lead to privilege escalation
kernel: heap-based overflow in LightNVM Subsystem may lead to privilege escalation
A heap-based buffer overflow was found in the Linux kernel's LightNVM subsystem. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length heap-based buffer. This vulnerability allows a local attacker to escalate privileges and execute arbitrary code in the context of the kernel. The attacker must first obtain the ability to execute high-privileged code on the target system to exploit this vulnerability.
A heap-based buffer overflow was found in the Linux kernel's LightNVM subsystem. This vulnerability allows a local attacker to escalate privileges and execute arbitrary code in the context of the kernel. The attacker must first obtain the
Debian
CVE-2022-2991: linux - A heap-based buffer overflow was found in the Linux kernel's LightNVM subsystem....
vendor_debian·2022·CVSS 6.7
CVE-2022-2991 [MEDIUM] CVE-2022-2991: linux - A heap-based buffer overflow was found in the Linux kernel's LightNVM subsystem....
A heap-based buffer overflow was found in the Linux kernel's LightNVM subsystem. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length heap-based buffer. This vulnerability allows a local attacker to escalate privileges and execute arbitrary code in the context of the kernel. The attacker must first obtain the ability to execute high-privileged code on the target system to exploit this vulnerability.
Scope: local
bookworm: resolved (fixed in 5.15.3-1)
bullseye: resolved (fixed in 5.10.120-1)
forky: resolved (fixed in 5.15.3-1)
sid: resolved (fixed in 5.15.3-1)
trixie: resolved (fixed in 5.15.3-1)
OSV
linux, linux-kvm, linux-lts-xenial vulnerabilities
osv·2023-04-12·CVSS 5.9
CVE-2020-36516 [MEDIUM] linux, linux-kvm, linux-lts-xenial vulnerabilities
linux, linux-kvm, linux-lts-xenial vulnerabilities
Xuewei Feng, Chuanpu Fu, Qi Li, Kun Sun, and Ke Xu discovered that the TCP
implementation in the Linux kernel did not properly handle IPID assignment.
A remote attacker could use this to cause a denial of service (connection
termination) or inject forged data. (CVE-2020-36516)
Ke Sun, Alyssa Milburn, Henrique Kawakami, Emma Benoit, Igor Chervatyuk,
Lisa Aichele, and Thais Moreira Hamasaki discovered that the Spectre
Variant 2 mitigations for AMD processors on Linux were insufficient in some
situations. A local attacker could possibly use this to expose sensitive
information. (CVE-2021-26401)
Jürgen Groß discovered that the Xen subsystem within the Linux kernel did
not adequately limit the number of events driver domains (unprivileged PV
OSV
linux-aws vulnerabilities
osv·2023-04-06·CVSS 5.9
CVE-2020-36516 [MEDIUM] linux-aws vulnerabilities
linux-aws vulnerabilities
Xuewei Feng, Chuanpu Fu, Qi Li, Kun Sun, and Ke Xu discovered that the TCP
implementation in the Linux kernel did not properly handle IPID assignment.
A remote attacker could use this to cause a denial of service (connection
termination) or inject forged data. (CVE-2020-36516)
Ke Sun, Alyssa Milburn, Henrique Kawakami, Emma Benoit, Igor Chervatyuk,
Lisa Aichele, and Thais Moreira Hamasaki discovered that the Spectre
Variant 2 mitigations for AMD processors on Linux were insufficient in some
situations. A local attacker could possibly use this to expose sensitive
information. (CVE-2021-26401)
Jürgen Groß discovered that the Xen subsystem within the Linux kernel did
not adequately limit the number of events driver domains (unprivileged PV
backends) could send to
GHSA
GHSA-9fpj-jhm5-p6h9: A heap-based buffer overflow was found in the Linux kernel's LightNVM subsystem
ghsa_unreviewed·2022-08-26
CVE-2022-2991 [MEDIUM] CWE-787 GHSA-9fpj-jhm5-p6h9: A heap-based buffer overflow was found in the Linux kernel's LightNVM subsystem
A heap-based buffer overflow was found in the Linux kernel's LightNVM subsystem. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length heap-based buffer. This vulnerability allows a local attacker to escalate privileges and execute arbitrary code in the context of the kernel. The attacker must first obtain the ability to execute high-privileged code on the target system to exploit this vulnerability.
OSV
CVE-2022-2991: A heap-based buffer overflow was found in the Linux kernel's LightNVM subsystem
osv·2022-08-25·CVSS 6.7
CVE-2022-2991 [MEDIUM] CVE-2022-2991: A heap-based buffer overflow was found in the Linux kernel's LightNVM subsystem
A heap-based buffer overflow was found in the Linux kernel's LightNVM subsystem. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length heap-based buffer. This vulnerability allows a local attacker to escalate privileges and execute arbitrary code in the context of the kernel. The attacker must first obtain the ability to execute high-privileged code on the target system to exploit this vulnerability.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/drivers/lightnvm/Kconfig?h=v5.10.114&id=549209caabc89f2877ad5f62d11fca5c052e0e8https://www.zerodayinitiative.com/advisories/ZDI-22-960/https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/drivers/lightnvm/Kconfig?h=v5.10.114&id=549209caabc89f2877ad5f62d11fca5c052e0e8https://www.zerodayinitiative.com/advisories/ZDI-22-960/
2022-08-25
Published