CVE-2022-41278
published 2022-12-13CVE-2022-41278: A vulnerability has been identified in JT2Go (All versions < V14.1.0.6), Teamcenter Visualization V13.2 (All versions < V13.2.0.12), Teamcenter Visualization…
PriorityP419medium5.5CVSS 3.1
AVLACLPRNUIRSUCNINAH
EPSS
0.26%
17.8th percentile
A vulnerability has been identified in JT2Go (All versions < V14.1.0.6), Teamcenter Visualization V13.2 (All versions < V13.2.0.12), Teamcenter Visualization V13.3 (All versions < V13.3.0.8), Teamcenter Visualization V14.0 (All versions < V14.0.0.4), Teamcenter Visualization V14.1 (All versions < V14.1.0.6). The CGM_NIST_Loader.dll contains a null pointer dereference vulnerability while parsing specially crafted CGM files. An attacker could leverage this vulnerability to crash the application causing denial of service condition.
Affected
10 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| siemens | jt2go | < 14.1.0.6 | 14.1.0.6 |
| siemens | jt2go | — | — |
| siemens | teamcenter_visualization | >= 13.2.0 < 13.2.0.12 | 13.2.0.12 |
| siemens | teamcenter_visualization | >= 13.3.0 < 13.3.0.8 | 13.3.0.8 |
| siemens | teamcenter_visualization | >= 14.0 < 14.0.0.4 | 14.0.0.4 |
| siemens | teamcenter_visualization | >= 14.1 < 14.1.0.6 | 14.1.0.6 |
| siemens | teamcenter_visualization_v13.2 | — | — |
| siemens | teamcenter_visualization_v13.3 | — | — |
| siemens | teamcenter_visualization_v14.0 | — | — |
| siemens | teamcenter_visualization_v14.1 | — | — |
CVSS provenance
nvdv3.15.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
vendor_redhat7.8HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-q45p-5p7p-5wgv: A vulnerability has been identified in JT2Go (All versions), Teamcenter Visualization V13
ghsa_unreviewed·2022-12-13
CVE-2022-41278 [MEDIUM] CWE-476 GHSA-q45p-5p7p-5wgv: A vulnerability has been identified in JT2Go (All versions), Teamcenter Visualization V13
A vulnerability has been identified in JT2Go (All versions), Teamcenter Visualization V13.2 (All versions < V13.2.0.12), Teamcenter Visualization V13.3 (All versions < V13.3.0.8), Teamcenter Visualization V14.0 (All versions < V14.0.0.4), Teamcenter Visualization V14.1 (All versions < V14.1.0.6). The CGM_NIST_Loader.dll contains a null pointer dereference vulnerability while parsing specially crafted CGM files. An attacker could leverage this vulnerability to crash the application causing denial of service condition.
Red Hat
kernel: net: sched: Fix use after free in red_enqueue()
vendor_redhat·2025-05-01·CVSS 7.8
CVE-2022-49921 [HIGH] CWE-681 kernel: net: sched: Fix use after free in red_enqueue()
kernel: net: sched: Fix use after free in red_enqueue()
In the Linux kernel, the following vulnerability has been resolved:
net: sched: Fix use after free in red_enqueue()
We can't use "skb" again after passing it to qdisc_enqueue(). This is
basically identical to commit 2f09707d0c97 ("sch_sfb: Also store skb
len before calling child enqueue").
Statement: The bug could happen only when qdisc with Random Early Detection (RED) packet scheduling algorithm being used. The security impact is limited.
Mitigation: To mitigate this issue, prevent module sch_red from being loaded. Please see https://access.redhat.com/solutions/41278 for how to blacklist a kernel module to prevent it from loading automatically.
Package: kernel (Red Hat Enterprise Linux 10) - Not affected
Package: kernel (Red Ha
Red Hat
kernel: ipv4: Fix data-races around sysctl_fib_multipath_hash_fields.
vendor_redhat·2025-02-26·CVSS 4.7
CVE-2022-49576 [MEDIUM] CWE-567 kernel: ipv4: Fix data-races around sysctl_fib_multipath_hash_fields.
kernel: ipv4: Fix data-races around sysctl_fib_multipath_hash_fields.
In the Linux kernel, the following vulnerability has been resolved:
ipv4: Fix data-races around sysctl_fib_multipath_hash_fields.
While reading sysctl_fib_multipath_hash_fields, it can be changed
concurrently. Thus, we need to add READ_ONCE() to its readers.
Statement: The bug is only about possibility of value corruption during reading sysctl_fib_multipath_hash_fields (and only if Mellanox Technologies Switch ASICs family hardware being used). No known vector of attack. The security impact is limited.
Mitigation: To mitigate this issue, prevent module mlxsw_core from being loaded. Please see https://access.redhat.com/solutions/41278 for how to blacklist a kernel module to prevent it from loading automatically.
Packa
Red Hat
kernel: usbnet: fix memory leak in error case
vendor_redhat·2025-02-26·CVSS 5.5
CVE-2022-49657 [MEDIUM] CWE-401 kernel: usbnet: fix memory leak in error case
kernel: usbnet: fix memory leak in error case
In the Linux kernel, the following vulnerability has been resolved:
usbnet: fix memory leak in error case
usbnet_write_cmd_async() mixed up which buffers
need to be freed in which error case.
v2: add Fixes tag
v3: fix uninitialized buf pointer
Statement: The bug could happen on error path for some specific cases of network links over USB being used. It leads to memory leak only, so the security impact is limited.
Mitigation: To mitigate this issue, prevent module usbnet from being loaded. Please see https://access.redhat.com/solutions/41278 for how to blacklist a kernel module to prevent it from loading automatically.
Package: kernel (Red Hat Enterprise Linux 10) - Not affected
Package: kernel (Red Hat Enterprise Linux 6) - Out of support
Red Hat
kernel: igb: Initialize mailbox message for VF reset
vendor_redhat·2024-10-21·CVSS 5.5
CVE-2022-48949 [MEDIUM] kernel: igb: Initialize mailbox message for VF reset
kernel: igb: Initialize mailbox message for VF reset
In the Linux kernel, the following vulnerability has been resolved:
igb: Initialize mailbox message for VF reset
When a MAC address is not assigned to the VF, that portion of the message
sent to the VF is not set. The memory, however, is allocated from the
stack meaning that information may be leaked to the VM. Initialize the
message buffer to 0 so that no information is passed to the VM in this
case.
Statement: Only small memory leak possible for specific case, so security impact is limited.
Mitigation: To mitigate this issue, prevent module igb from being loaded. Please see https://access.redhat.com/solutions/41278 for how to blacklist a kernel module to prevent it from loading automatically.
Package: kernel (Red Hat Enterprise Lin
CISA ICS
Siemens Teamcenter Visualization and JT2Go
cisa_ics·2022-12-15·CVSS 3.3
[LOW] Siemens Teamcenter Visualization and JT2Go
## Archived Content In an effort to keep CISA.gov current, the archive contains outdated information that may not reflect current policy or programs.
ICS Advisory
##
Siemens Teamcenter Visualization and JT2Go
Last RevisedDecember 15, 2022
Alert CodeICSA-22-349-20
## As of January 10, 2023, CISA will no longer be updating ICS security advisories for Siemens product vulnerabilities beyond the initial advisory. For the most up-to-date information on vulnerabilities in this advisory, please see Siemens' ProductCERT Security Advisories (CERT Services | Services | Siemens Global).
## 1. EXECUTIVE SUMMARY
- CVSS v3 7.8
- ATTENTION: Low attack complexity
- Vendor: Siemens
- Equipment: Teamcenter Visualization and JT2Go
- Vulnerabilities: NULL P
Red Hat
kernel: Use-after-Free/Double-Free bug in read_bbreg_hdl in drivers/staging/rtl8712/rtl8712_cmd.c
vendor_redhat·2022-11-18·CVSS 7.8
CVE-2022-4095 [HIGH] CWE-416 kernel: Use-after-Free/Double-Free bug in read_bbreg_hdl in drivers/staging/rtl8712/rtl8712_cmd.c
kernel: Use-after-Free/Double-Free bug in read_bbreg_hdl in drivers/staging/rtl8712/rtl8712_cmd.c
A use-after-free flaw was found in Linux kernel before 5.19.2. This issue occurs in cmd_hdl_filter in drivers/staging/rtl8712/rtl8712_cmd.c, allowing an attacker to launch a local denial of service attack and gain escalation of privileges.
A use-after-free flaw was found in Linux kernel before 5.19.2. This issue occurs in cmd_hdl_filter in drivers/staging/rtl8712/rtl8712_cmd.c, allowing an attacker to launch a local denial of service attack and gain escalation of privileges.
Mitigation: To mitigate this issue, prevent the affected module from being loaded.
Please see https://access.redhat.com/solutions/41278 for information on how to blacklist a kernel module to prevent it from loading auto
Red Hat
kernel: USB-accessible buffer overflow in brcmfmac
vendor_redhat·2022-10-22·CVSS 6.6
CVE-2022-3628 [MEDIUM] CWE-120 kernel: USB-accessible buffer overflow in brcmfmac
kernel: USB-accessible buffer overflow in brcmfmac
A buffer overflow flaw was found in the Linux kernel Broadcom Full MAC Wi-Fi driver. This issue occurs when a user connects to a malicious USB device. This can allow a local user to crash the system or escalate their privileges.
A buffer overflow flaw was found in the Linux kernel Broadcom Full MAC Wi-Fi driver. This issue occurs when a user connects to a malicious USB device. This can allow a local user to crash the system or escalate their privileges.
Mitigation: To mitigate this issue, prevent the brcmfmac module from being loaded. See https://access.redhat.com/solutions/41278 for how to blacklist a kernel module to prevent it from loading automatically.
Package: kernel (Red Hat Enterprise Linux 6) - Out of support scope
Package: k
Red Hat
kernel: Denial of service in beacon protection for P2P-device
vendor_redhat·2022-10-13·CVSS 5.5
CVE-2022-42722 [MEDIUM] CWE-705 kernel: Denial of service in beacon protection for P2P-device
kernel: Denial of service in beacon protection for P2P-device
In the Linux kernel 5.8 through 5.19.x before 5.19.16, local attackers able to inject WLAN frames into the mac80211 stack could cause a NULL pointer dereference denial-of-service attack against the beacon protection of P2P devices.
A flaw was found in P2P-Device in wifi in ieee80211_rx_h_decrypt in net/mac80211/rx.c in the Linux kernel, leading to a denial of service.
Mitigation: To mitigate this issue, prevent module mac80211 from being loaded. Please see https://access.redhat.com/solutions/41278 for how to blacklist a kernel module to prevent it from loading automatically.
Package: kernel (Red Hat Enterprise Linux 6) - Not affected
Package: kernel (Red Hat Enterprise Linux 7) - Not affected
Package: kernel-rt (Red Hat En
Red Hat
kernel: A flaw in bnx2x_tpa_stop in drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c lead to memory leak
vendor_redhat·2022-09-30·CVSS 3.3
CVE-2022-3542 [LOW] CWE-401 kernel: A flaw in bnx2x_tpa_stop in drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c lead to memory leak
kernel: A flaw in bnx2x_tpa_stop in drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c lead to memory leak
A memory leak flaw was found in bnx2x_tpa_stop in drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c in the bnx2x sub-component in the Linux Kernel. This flaw may allow a local attacker to cause a denial of service.
Mitigation: This flaw can be mitigated by preventing the affected bnx2x kernel module from loading during the boot time, ensure the module is added into the blacklist file.
~~~
Refer to:
How do I blacklist a kernel module to prevent it from loading automatically?
https://access.redhat.com/solutions/41278
~~~
Package: kernel (Red Hat Enterprise Linux 6) - Out of support scope
Package: kernel (Red Hat Enterprise Linux 7) - Out of support scope
Package: kernel-rt (Red Hat Ente
Red Hat
kernel: netfilter: nf_conntrack_irc message handling issue
vendor_redhat·2022-08-30·CVSS 5.3
CVE-2022-2663 [MEDIUM] CWE-923 kernel: netfilter: nf_conntrack_irc message handling issue
kernel: netfilter: nf_conntrack_irc message handling issue
An issue was found in the Linux kernel in nf_conntrack_irc where the message handling can be confused and incorrectly matches the message. A firewall may be able to be bypassed when users are using unencrypted IRC with nf_conntrack_irc configured.
A flaw was found in the Linux kernel in nf_conntrack_irc where the message handling can be confused and it incorrectly matches on the message. An attacker could exploit this vulnerability to bypass firewall when users are using unencrypted IRC with nf_conntrack_irc configured.
Mitigation: To mitigate this issue, prevent the module nf_conntrack_irc from being loaded. Please see https://access.redhat.com/solutions/41278 for information on how to blacklist a kernel module to prevent it fr
Red Hat
kernel: An invalid pipe direction in the mceusb driver cause the kernel to DOS
vendor_redhat·2022-08-11·CVSS 4.6
CVE-2022-3903 [MEDIUM] CWE-843 kernel: An invalid pipe direction in the mceusb driver cause the kernel to DOS
kernel: An invalid pipe direction in the mceusb driver cause the kernel to DOS
An incorrect read request flaw was found in the Infrared Transceiver USB driver in the Linux kernel. This issue occurs when a user attaches a malicious USB device. A local user could use this flaw to starve the resources, causing denial of service or potentially crashing the system.
An incorrect read request flaw was found in the Infrared Transceiver USB driver in the Linux kernel. This issue occurs when a user attaches a malicious USB device. A local user could use this flaw to starve the resources, causing denial of service or potentially crashing the system.
Mitigation: To mitigate this issue, prevent the mceusb module from being loaded. Please see https://access.redhat.com/solutions/41278 for information
Red Hat
kernel: an out-of-bounds vulnerability in i2c-ismt driver
vendor_redhat·2022-07-29·CVSS 5.5
CVE-2022-2873 [MEDIUM] CWE-131 kernel: an out-of-bounds vulnerability in i2c-ismt driver
kernel: an out-of-bounds vulnerability in i2c-ismt driver
An out-of-bounds memory access flaw was found in the Linux kernel Intel’s iSMT SMBus host controller driver in the way a user triggers the I2C_SMBUS_BLOCK_DATA (with the ioctl I2C_SMBUS) with malicious input data. This flaw allows a local user to crash the system.
An out-of-bounds memory access flaw was found in the Linux kernel Intel’s iSMT SMBus host controller driver in the way a user triggers the I2C_SMBUS_BLOCK_DATA (with the ioctl I2C_SMBUS) with malicious input data. This flaw allows a local user to crash the system.
Mitigation: To mitigate this issue, prevent module i2c-ismt from being loaded. Please see https://access.redhat.com/solutions/41278 for information on how to blacklist a kernel module to prevent it from loadin
Red Hat
kernel: DoS in nfqnl_mangle in net/netfilter/nfnetlink_queue.c
vendor_redhat·2022-07-26·CVSS 7.5
CVE-2022-36946 [HIGH] kernel: DoS in nfqnl_mangle in net/netfilter/nfnetlink_queue.c
kernel: DoS in nfqnl_mangle in net/netfilter/nfnetlink_queue.c
nfqnl_mangle in net/netfilter/nfnetlink_queue.c in the Linux kernel through 5.18.14 allows remote attackers to cause a denial of service (panic) because, in the case of an nf_queue verdict with a one-byte nfta_payload attribute, an skb_pull can encounter a negative skb->len.
A memory corruption flaw was found in the Linux kernel’s Netfilter subsystem in the way a local user uses the libnetfilter_queue when analyzing a corrupted network packet. This flaw allows a local user to crash the system or a remote user to crash the system when the libnetfilter_queue is used by a local user.
Mitigation: To mitigate this issue, prevent the module nfnetlink_queue from being loaded. Please see https://access.redhat.com/solutions/41278 for
Red Hat
kernel: possible use after free in lock_sock_nested of sock.c for the SCTP protocol
vendor_redhat·2022-06-15·CVSS 6.4
CVE-2022-20154 [MEDIUM] kernel: possible use after free in lock_sock_nested of sock.c for the SCTP protocol
kernel: possible use after free in lock_sock_nested of sock.c for the SCTP protocol
In lock_sock_nested of sock.c, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-174846563References: Upstream kernel
A use-after-free flaw due to a race condition was found in the Linux kernel’s sctp_diag module. This flaw allows a local user to crash or potentially escalate their privileges on the system.
Mitigation: To mitigate this issue, prevent the sctp module from being loaded. Please see https://access.redhat.com/solutions/41278 for how to blacklist a kernel module to prevent it from loading automa
Red Hat
kernel: use after free in SUNRPC subsystem
vendor_redhat·2022-04-11·CVSS 7.8
CVE-2022-28893 [HIGH] CWE-416 kernel: use after free in SUNRPC subsystem
kernel: use after free in SUNRPC subsystem
The SUNRPC subsystem in the Linux kernel through 5.17.2 can call xs_xprt_free before ensuring that sockets are in the intended state.
A use-after-free flaw was found in the Linux kernel’s net/sunrpc/xprt.c function in the Remote Procedure Call (SunRPC) protocol. This flaw allows a local attacker to crash the system, leading to a kernel information leak issue.
Mitigation: This flaw can be mitigated by preventing the affected SUNRPC driver (sunrpc) kernel module from loading during the boot time, ensuring the module is added to the blacklist file.
~~~
Refer:
How do I blacklist a kernel module to prevent it from loading automatically?
https://access.redhat.com/solutions/41278
~~~
Package: kernel (Red Hat Enterprise Linux 6) - Out of support scope
Red Hat
kernel: a use-after-free caused by a transaction_t race condition
vendor_redhat·2022-04-08·CVSS 7.0
CVE-2022-28796 [HIGH] CWE-416 kernel: a use-after-free caused by a transaction_t race condition
kernel: a use-after-free caused by a transaction_t race condition
jbd2_journal_wait_updates in fs/jbd2/transaction.c in the Linux kernel before 5.17.1 has a use-after-free caused by a transaction_t race condition.
A use-after-free flaw was found in the Linux kernel’s journaling layer of the ext4 and OCFS2 file system functionality in the way a user can trigger a race condition during writing to the file system. This flaw allows a local user to crash or potentially escalate their privileges on the system.
Statement: This kind of race condition is hard to trigger and there are no known reproducers to trigger it, so keeping the impact moderate.
Mitigation: To mitigate this issue, prevent the module jbd2 from being loaded. Please see https://access.redhat.com/solutions/41278 for informatio
Red Hat
kernel: double free in usb_8dev_start_xmit in drivers/net/can/usb/usb_8dev.c
vendor_redhat·2022-04-04·CVSS 5.5
CVE-2022-28388 [MEDIUM] CWE-415 kernel: double free in usb_8dev_start_xmit in drivers/net/can/usb/usb_8dev.c
kernel: double free in usb_8dev_start_xmit in drivers/net/can/usb/usb_8dev.c
usb_8dev_start_xmit in drivers/net/can/usb/usb_8dev.c in the Linux kernel through 5.17.1 has a double free.
A double-free flaw was found in the Linux kernel's USB2CAN interface implementation. This issue could allow a local user to crash the system.
Statement: This issue is Moderate because this case doesn't lead to a kernel crash as result of the pointers reference check preventing actual second memory free. The only known attack scenario is the possibility of a denial of service.
Mitigation: To mitigate this issue, prevent module usb_8dev from being loaded. Please see https://access.redhat.com/solutions/41278 for how to blacklist a kernel module to prevent it from loading automatically.
Package: kernel (Red
Red Hat
kernel: media: em28xx: initialize refcount before kref_get
vendor_redhat·2022-02-22·CVSS 7.8
CVE-2022-3239 [HIGH] CWE-416 kernel: media: em28xx: initialize refcount before kref_get
kernel: media: em28xx: initialize refcount before kref_get
A flaw use after free in the Linux kernel video4linux driver was found in the way user triggers em28xx_usb_probe() for the Empia 28xx based TV cards. A local user could use this flaw to crash the system or potentially escalate their privileges on the system.
A use-after-free flaw was found in the Linux kernel’s video4linux driver in how a user triggers the em28xx_usb_probe() for the Empia 28xx-based TV cards. This flaw allows a local user to crash or potentially escalate their privileges on the system.
Mitigation: To mitigate this issue, prevent module em28xx from being loaded. Please see https://access.redhat.com/solutions/41278 for how to blacklist a kernel module to prevent it from loading automatically.
Package: kernel (Red
Red Hat
kernel: Local denial of service in bond_ipsec_add_sa
vendor_redhat·2021-07-06·CVSS 5.5
CVE-2022-0286 [MEDIUM] CWE-476 kernel: Local denial of service in bond_ipsec_add_sa
kernel: Local denial of service in bond_ipsec_add_sa
A flaw was found in the Linux kernel. A null pointer dereference in bond_ipsec_add_sa() may lead to local denial of service.
A NULL pointer dereference flaw was found in the Linux kernel’s bonding driver in the way a user bonds non existing or fake device. This flaw allows a local user to crash the system, causing a denial of service.
Mitigation: To mitigate this issue, prevent the module bonding from being loaded. Please see https://access.redhat.com/solutions/41278 for information on how to blacklist a kernel module to prevent it from loading automatically.
Package: kernel (Red Hat Enterprise Linux 6) - Not affected
Package: kernel (Red Hat Enterprise Linux 7) - Not affected
Package: kernel-rt (Red Hat Enterprise Linux 7) - Not a
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2022-12-13
Published