CVE-2022-3541
published 2022-10-17CVE-2022-3541: A vulnerability classified as critical has been found in Linux Kernel. This affects the function spl2sw_nvmem_get_mac_address of the file…
PriorityP337high7.8CVSS 3.1
AVLACLPRLUINSUCHIHAH
EPSS
0.33%
25.9th percentile
A vulnerability classified as critical has been found in Linux Kernel. This affects the function spl2sw_nvmem_get_mac_address of the file drivers/net/ethernet/sunplus/spl2sw_driver.c of the component BPF. The manipulation leads to use after free. It is recommended to apply a patch to fix this issue. The identifier VDB-211041 was assigned to this vulnerability.
Affected
9 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 6.0.3-1 (bookworm) | linux 6.0.3-1 (bookworm) |
| linux | kernel | — | — |
| linux | linux_kernel | >= 0 < 6.0.3-1 | 6.0.3-1 |
| linux | linux_kernel | >= 0 < 6.0.3-1 | 6.0.3-1 |
| linux | linux_kernel | >= 0 < 6.0.3-1 | 6.0.3-1 |
| linux | linux_kernel | >= 5.19 < 5.19.17 | 5.19.17 |
| linux | linux_kernel | >= 6.0 < 6.0.3 | 6.0.3 |
| msrc | cbl2_kernel_5.15.74.1-3_on_cbl_mariner_2.0 | — | — |
| msrc | cm1_kernel_5.10.149.1-1_on_cbl_mariner_1.0 | — | — |
CVSS provenance
nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
osv7.8HIGH
vendor_msrc7.8HIGH
vendor_ubuntu7.8HIGH
vendor_debian5.5MEDIUM
vendor_redhat5.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
Linux kernel (IBM) vulnerabilities
vendor_ubuntu·2023-01-10·CVSS 7.8
CVE-2022-3541 [HIGH] Linux kernel (IBM) vulnerabilities
Title: Linux kernel (IBM) vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
It was discovered that the io_uring subsystem in the Linux kernel did not
properly perform reference counting in some situations, leading to a use-
after-free vulnerability. A local attacker could use this to cause a denial
of service (system crash) or possibly execute arbitrary code.
(CVE-2022-3910)
It was discovered that a race condition existed in the Android Binder IPC
subsystem in the Linux kernel, leading to a use-after-free vulnerability. A
local attacker could use this to cause a denial of service (system crash)
or possibly execute arbitrary code. (CVE-2022-20421)
David Leadbeater discovered that the netfilter IRC protocol tracking
implementation in the Linux Kernel incorr
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2023-01-10·CVSS 7.8
CVE-2022-3910 [HIGH] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
It was discovered that the io_uring subsystem in the Linux kernel did not
properly perform reference counting in some situations, leading to a use-
after-free vulnerability. A local attacker could use this to cause a denial
of service (system crash) or possibly execute arbitrary code.
(CVE-2022-3910)
It was discovered that a race condition existed in the Android Binder IPC
subsystem in the Linux kernel, leading to a use-after-free vulnerability. A
local attacker could use this to cause a denial of service (system crash)
or possibly execute arbitrary code. (CVE-2022-20421)
David Leadbeater discovered that the netfilter IRC protocol tracking
implementation in the Linux Kernel incorrectly
Ubuntu
Linux kernel (Azure) vulnerabilities
vendor_ubuntu·2023-01-09·CVSS 7.8
CVE-2022-3623 [HIGH] Linux kernel (Azure) vulnerabilities
Title: Linux kernel (Azure) vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
It was discovered that the io_uring subsystem in the Linux kernel did not
properly perform reference counting in some situations, leading to a use-
after-free vulnerability. A local attacker could use this to cause a denial
of service (system crash) or possibly execute arbitrary code.
(CVE-2022-3910)
It was discovered that a race condition existed in the Android Binder IPC
subsystem in the Linux kernel, leading to a use-after-free vulnerability. A
local attacker could use this to cause a denial of service (system crash)
or possibly execute arbitrary code. (CVE-2022-20421)
David Leadbeater discovered that the netfilter IRC protocol tracking
implementation in the Linux Kernel inco
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2023-01-06·CVSS 7.8
CVE-2022-3623 [HIGH] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
It was discovered that the io_uring subsystem in the Linux kernel did not
properly perform reference counting in some situations, leading to a use-
after-free vulnerability. A local attacker could use this to cause a denial
of service (system crash) or possibly execute arbitrary code.
(CVE-2022-3910)
It was discovered that a race condition existed in the Android Binder IPC
subsystem in the Linux kernel, leading to a use-after-free vulnerability. A
local attacker could use this to cause a denial of service (system crash)
or possibly execute arbitrary code. (CVE-2022-20421)
David Leadbeater discovered that the netfilter IRC protocol tracking
implementation in the Linux Kernel incorrectly
Microsoft
Linux Kernel BPF spl2sw_driver.c spl2sw_nvmem_get_mac_address use after free
vendor_msrc·2022-10-11·CVSS 7.8
CVE-2022-3541 [MEDIUM] CWE-119 Linux Kernel BPF spl2sw_driver.c spl2sw_nvmem_get_mac_address use after free
Linux Kernel BPF spl2sw_driver.c spl2sw_nvmem_get_mac_address use after free
FAQ: Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability?
One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source libraries with which the distro is composed. Microsoft is committed to transparency in this work which is why we began publishing CSAF/VEX in October 2025. See this blog post for more information. If impact to additional products is identified, we will update the CVE to reflect this.
Mariner: Mariner
VulDB: VulDB
Customer Action Required: Yes
Remediation: CBL-Mariner Releases
Ref
Red Hat
kernel: use after free bug in spl2sw_nvmem_get_mac_address
vendor_redhat·2022-10-01·CVSS 5.5
CVE-2022-3541 [MEDIUM] CWE-416 kernel: use after free bug in spl2sw_nvmem_get_mac_address
kernel: use after free bug in spl2sw_nvmem_get_mac_address
A vulnerability classified as critical has been found in Linux Kernel. This affects the function spl2sw_nvmem_get_mac_address of the file drivers/net/ethernet/sunplus/spl2sw_driver.c of the component BPF. The manipulation leads to use after free. It is recommended to apply a patch to fix this issue. The identifier VDB-211041 was assigned to this vulnerability.
Statement: There was no shipped kernel version were seen affected with this problem. These files are not built in our source code.
Package: kernel (Red Hat Enterprise Linux 6) - Not affected
Package: kernel (Red Hat Enterprise Linux 7) - Not affected
Package: kernel-rt (Red Hat Enterprise Linux 7) - Not affected
Package: kernel (Red Hat Enterprise Linux 8) - Not affecte
Debian
CVE-2022-3541: linux - A vulnerability classified as critical has been found in Linux Kernel. This affe...
vendor_debian·2022·CVSS 5.5
CVE-2022-3541 [MEDIUM] CVE-2022-3541: linux - A vulnerability classified as critical has been found in Linux Kernel. This affe...
A vulnerability classified as critical has been found in Linux Kernel. This affects the function spl2sw_nvmem_get_mac_address of the file drivers/net/ethernet/sunplus/spl2sw_driver.c of the component BPF. The manipulation leads to use after free. It is recommended to apply a patch to fix this issue. The identifier VDB-211041 was assigned to this vulnerability.
Scope: local
bookworm: resolved (fixed in 6.0.3-1)
bullseye: resolved
forky: resolved (fixed in 6.0.3-1)
sid: resolved (fixed in 6.0.3-1)
trixie: resolved (fixed in 6.0.3-1)
VulDB
Linux Kernel BPF spl2sw_driver.c spl2sw_nvmem_get_mac_address use after free (EUVD-2022-42907)
vuldb·2026-07-16·CVSS 7.8
CVE-2022-3541 [HIGH] Linux Kernel BPF spl2sw_driver.c spl2sw_nvmem_get_mac_address use after free (EUVD-2022-42907)
A vulnerability was found in Linux Kernel and classified as critical. Impacted is the function spl2sw_nvmem_get_mac_address of the file drivers/net/ethernet/sunplus/spl2sw_driver.c of the component BPF. Such manipulation leads to use after free.
This vulnerability is referenced as CVE-2022-3541. The attack needs to be initiated within the local network. No exploit is available.
Applying a patch is advised to resolve this issue.
OSV
CVE-2022-3541: A vulnerability classified as critical has been found in Linux Kernel
osv·2022-10-17·CVSS 7.8
CVE-2022-3541 [HIGH] CVE-2022-3541: A vulnerability classified as critical has been found in Linux Kernel
A vulnerability classified as critical has been found in Linux Kernel. This affects the function spl2sw_nvmem_get_mac_address of the file drivers/net/ethernet/sunplus/spl2sw_driver.c of the component BPF. The manipulation leads to use after free. It is recommended to apply a patch to fix this issue. The identifier VDB-211041 was assigned to this vulnerability.
GHSA
GHSA-mhhv-2rpc-5pwq: A vulnerability classified as critical has been found in Linux Kernel
ghsa_unreviewed·2022-10-17
CVE-2022-3541 [HIGH] CWE-119 GHSA-mhhv-2rpc-5pwq: A vulnerability classified as critical has been found in Linux Kernel
A vulnerability classified as critical has been found in Linux Kernel. This affects the function spl2sw_nvmem_get_mac_address of the file drivers/net/ethernet/sunplus/spl2sw_driver.c of the component BPF. The manipulation leads to use after free. It is recommended to apply a patch to fix this issue. The identifier VDB-211041 was assigned to this vulnerability.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next.git/commit/?id=12aece8b01507a2d357a1861f470e83621fbb6f2https://security.netapp.com/advisory/ntap-20221228-0001/https://vuldb.com/?id.211041https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next.git/commit/?id=12aece8b01507a2d357a1861f470e83621fbb6f2https://security.netapp.com/advisory/ntap-20221228-0001/https://vuldb.com/?id.211041
2022-10-17
Published