CVE-2022-3977
published 2023-01-12CVE-2022-3977: A use-after-free flaw was found in the Linux kernel MCTP (Management Component Transport Protocol) functionality. This issue occurs when a user simultaneously…
PriorityP340high7.8CVSS 3.1
AVLACLPRLUINSUCHIHAH
EPSS
0.25%
16.3th percentile
A use-after-free flaw was found in the Linux kernel MCTP (Management Component Transport Protocol) functionality. This issue occurs when a user simultaneously calls DROPTAG ioctl and socket close happens, which could allow a local user to crash the system or potentially escalate their privileges on the system.
Affected
8 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| chainsafe | lodestar | >= 0 < 0.36.0 | 0.36.0 |
| debian | linux | < linux 6.0.2-1 (bookworm) | linux 6.0.2-1 (bookworm) |
| linux | linux_kernel | — | — |
| linux | linux_kernel | >= 0 < 6.0.2-1 | 6.0.2-1 |
| linux | linux_kernel | >= 0 < 6.0.2-1 | 6.0.2-1 |
| linux | linux_kernel | >= 0 < 6.0.2-1 | 6.0.2-1 |
| linux | linux_kernel | >= 5.18 < 5.19.16 | 5.19.16 |
| linux | linux_kernel | >= 6.0 < 6.0.2 | 6.0.2 |
CVSS provenance
nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
osv7.8HIGH
vendor_debian7.8HIGH
vendor_redhat7.8HIGH
vendor_ubuntu7.8HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
Linux kernel (IBM) vulnerabilities
vendor_ubuntu·2023-01-10·CVSS 7.8
CVE-2022-3541 [HIGH] Linux kernel (IBM) vulnerabilities
Title: Linux kernel (IBM) vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
It was discovered that the io_uring subsystem in the Linux kernel did not
properly perform reference counting in some situations, leading to a use-
after-free vulnerability. A local attacker could use this to cause a denial
of service (system crash) or possibly execute arbitrary code.
(CVE-2022-3910)
It was discovered that a race condition existed in the Android Binder IPC
subsystem in the Linux kernel, leading to a use-after-free vulnerability. A
local attacker could use this to cause a denial of service (system crash)
or possibly execute arbitrary code. (CVE-2022-20421)
David Leadbeater discovered that the netfilter IRC protocol tracking
implementation in the Linux Kernel incorr
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2023-01-10·CVSS 7.8
CVE-2022-3910 [HIGH] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
It was discovered that the io_uring subsystem in the Linux kernel did not
properly perform reference counting in some situations, leading to a use-
after-free vulnerability. A local attacker could use this to cause a denial
of service (system crash) or possibly execute arbitrary code.
(CVE-2022-3910)
It was discovered that a race condition existed in the Android Binder IPC
subsystem in the Linux kernel, leading to a use-after-free vulnerability. A
local attacker could use this to cause a denial of service (system crash)
or possibly execute arbitrary code. (CVE-2022-20421)
David Leadbeater discovered that the netfilter IRC protocol tracking
implementation in the Linux Kernel incorrectly
Ubuntu
Linux kernel (Azure) vulnerabilities
vendor_ubuntu·2023-01-09·CVSS 7.8
CVE-2022-3623 [HIGH] Linux kernel (Azure) vulnerabilities
Title: Linux kernel (Azure) vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
It was discovered that the io_uring subsystem in the Linux kernel did not
properly perform reference counting in some situations, leading to a use-
after-free vulnerability. A local attacker could use this to cause a denial
of service (system crash) or possibly execute arbitrary code.
(CVE-2022-3910)
It was discovered that a race condition existed in the Android Binder IPC
subsystem in the Linux kernel, leading to a use-after-free vulnerability. A
local attacker could use this to cause a denial of service (system crash)
or possibly execute arbitrary code. (CVE-2022-20421)
David Leadbeater discovered that the netfilter IRC protocol tracking
implementation in the Linux Kernel inco
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2023-01-06·CVSS 7.8
CVE-2022-3623 [HIGH] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
It was discovered that the io_uring subsystem in the Linux kernel did not
properly perform reference counting in some situations, leading to a use-
after-free vulnerability. A local attacker could use this to cause a denial
of service (system crash) or possibly execute arbitrary code.
(CVE-2022-3910)
It was discovered that a race condition existed in the Android Binder IPC
subsystem in the Linux kernel, leading to a use-after-free vulnerability. A
local attacker could use this to cause a denial of service (system crash)
or possibly execute arbitrary code. (CVE-2022-20421)
David Leadbeater discovered that the netfilter IRC protocol tracking
implementation in the Linux Kernel incorrectly
Red Hat
kernel: use-after-free bug in mctp_sk_unhash in net/mctp/af_mctp.c
vendor_redhat·2022-10-23·CVSS 7.8
CVE-2022-3977 [HIGH] CWE-416 kernel: use-after-free bug in mctp_sk_unhash in net/mctp/af_mctp.c
kernel: use-after-free bug in mctp_sk_unhash in net/mctp/af_mctp.c
A use-after-free flaw was found in the Linux kernel MCTP (Management Component Transport Protocol) functionality. This issue occurs when a user simultaneously calls DROPTAG ioctl and socket close happens, which could allow a local user to crash the system or potentially escalate their privileges on the system.
A use-after-free flaw was found in the Linux kernel MCTP (Management Component Transport Protocol) functionality. This issue occurs when a user simultaneously calls DROPTAG ioctl and socket close happens, which could allow a local user to crash the system or potentially escalate their privileges on the system.
Package: kernel (Red Hat Enterprise Linux 6) - Not affected
Package: kernel (Red Hat Enterprise Linux 7)
Debian
CVE-2022-3977: linux - A use-after-free flaw was found in the Linux kernel MCTP (Management Component T...
vendor_debian·2022·CVSS 7.8
CVE-2022-3977 [HIGH] CVE-2022-3977: linux - A use-after-free flaw was found in the Linux kernel MCTP (Management Component T...
A use-after-free flaw was found in the Linux kernel MCTP (Management Component Transport Protocol) functionality. This issue occurs when a user simultaneously calls DROPTAG ioctl and socket close happens, which could allow a local user to crash the system or potentially escalate their privileges on the system.
Scope: local
bookworm: resolved (fixed in 6.0.2-1)
bullseye: resolved
forky: resolved (fixed in 6.0.2-1)
sid: resolved (fixed in 6.0.2-1)
trixie: resolved (fixed in 6.0.2-1)
OSV
CVE-2022-3977: A use-after-free flaw was found in the Linux kernel MCTP (Management Component Transport Protocol) functionality
osv·2023-01-12·CVSS 7.8
CVE-2022-3977 [HIGH] CVE-2022-3977: A use-after-free flaw was found in the Linux kernel MCTP (Management Component Transport Protocol) functionality
A use-after-free flaw was found in the Linux kernel MCTP (Management Component Transport Protocol) functionality. This issue occurs when a user simultaneously calls DROPTAG ioctl and socket close happens, which could allow a local user to crash the system or potentially escalate their privileges on the system.
GHSA
GHSA-6fr8-22pf-g32x: A use-after-free flaw was found in the Linux kernel MCTP (Management Component Transport Protocol) functionality
ghsa_unreviewed·2023-01-12
CVE-2022-3977 [HIGH] CWE-416 GHSA-6fr8-22pf-g32x: A use-after-free flaw was found in the Linux kernel MCTP (Management Component Transport Protocol) functionality
A use-after-free flaw was found in the Linux kernel MCTP (Management Component Transport Protocol) functionality. This issue occurs when a user simultaneously calls DROPTAG ioctl and socket close happens, which could allow a local user to crash the system or potentially escalate their privileges on the system.
GHSA
AttesterSlashing number overflow
ghsa·2022-05-24
CVE-2022-29219 [HIGH] CWE-190 AttesterSlashing number overflow
AttesterSlashing number overflow
### Impact
Possible consensus split given maliciously-crafted `AttesterSlashing` or `ProposerSlashing` being included on-chain.
Since we represent `uint64` values as native javascript `number`s, there is an issue when those variables with large (greater than 2^53) `uint64` values are included on chain. In those cases, Lodestar may view _valid_ `AttesterSlashing` or `ProposerSlashing` as _invalid_, due to rounding errors in large `number` values. This causes a consensus split, where Lodestar nodes are forked away from the main network.
Similarly Lodestar may consider _invalid_ `ProposerSlashing` as _valid_, thus including in proposed blocks that will be considered invalid by the network.
### Patches
https://github.com/ChainSafe/lodestar/pull/3977
###
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=3a732b46736cd8a29092e4b0b1a9ba83e672bf89https://security.netapp.com/advisory/ntap-20230223-0005/https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=3a732b46736cd8a29092e4b0b1a9ba83e672bf89https://security.netapp.com/advisory/ntap-20230223-0005/
2023-01-12
Published