CVE-2022-4129 — Improper Locking in Layer 2 Tunneling Protocol

CWE-667 — Improper LockingCWE-362 — Race ConditionCWE-413 — Improper Resource Locking27 documents7 sources
Severity
5.5MEDIUMNVD
OSV4.7
EPSS
0.0%
top 94.65%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
4
Linux KernelLinux Layer 2 Tunneling ProtocolDebian Linux+1 more
Timeline
PublishedNov 28
Latest updateJul 27

Description

A flaw was found in the Linux kernel's Layer 2 Tunneling Protocol (L2TP). A missing lock when clearing sk_user_data can lead to a race condition and NULL pointer dereference. A local user could use this flaw to potentially crash the system causing a denial of service.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HExploitability: 1.8 | Impact: 3.6

Affected Packages4 packages

▶Debianlinux/linux_kernel< 5.10.178-1+3
▶Ubuntulinux/linux_kernel< 5.4.0-147.164+1
▶debiandebian/linux< linux 6.1.4-1 (bookworm)

Also affects: Fedora 35, 36, 37

🔴Vulnerability Details

12
OSV
linux-iot vulnerabilities↗2023-07-27
▶
OSV
linux-xilinx-zynqmp vulnerabilities↗2023-07-12
▶
OSV
linux-intel-iotg-5.15 vulnerabilities↗2023-06-01
▶
OSV
linux-gcp, linux-hwe-5.19 vulnerabilities↗2023-05-22
▶
OSV
linux-bluefield vulnerabilities↗2023-05-22
▶

📋Vendor Advisories

14
Ubuntu
Linux kernel (IoT) vulnerabilities↗2023-07-27
▶
Ubuntu
Linux kernel (Xilinx ZynqMP) vulnerabilities↗2023-07-12
▶
CISA ICS
Siemens SIMATIC S7-1500 TM MFP Linux Kernel↗2023-06-15
▶
Ubuntu
Linux kernel (Intel IoTG) vulnerabilities↗2023-06-01
▶
Ubuntu
Linux kernel vulnerabilities↗2023-05-22
▶