CVE-2022-42432 — Use of Uninitialized Variable in Linux

Vendor	Product	Version range	Fixed in
debian	linux	< linux 6.0.2-1 (bookworm)	linux 6.0.2-1 (bookworm)
linux	kernel	—	—
linux	linux_kernel	—	—
linux	linux_kernel	>= 0 < 5.10.148-1	5.10.148-1
linux	linux_kernel	>= 0 < 6.0.2-1	6.0.2-1
linux	linux_kernel	>= 0 < 6.0.2-1	6.0.2-1
linux	linux_kernel	>= 0 < 6.0.2-1	6.0.2-1

CISA ICS

Siemens SIMATIC S7-1500 TM MFP Linux Kernel

cisa_ics·2023-06-15·CVSS 5.5

[MEDIUM] Siemens SIMATIC S7-1500 TM MFP Linux Kernel ICS Advisory ## Siemens SIMATIC S7-1500 TM MFP Linux Kernel Release DateJune 15, 2023 Alert CodeICSA-23-166-11 ## As of January 10, 2023, CISA will no longer be updating ICS security advisories for Siemens product vulnerabilities beyond the initial advisory. For the most up-to-date information on vulnerabilities in this advisory, please see Siemens' ProductCERT Security Advisories (CERT Services | Services | Siemens Global). ## 1. EXECUTIVE SUMMARY - CVSS v3 9.8 - ATTENTION: Exploitable remotely / low attack complexity / public exploits available - Vendor: Siemens ProductCERT - Equipment: SIMATIC S7-1500 TM MFP - Vulnerabilities: Multiple vulnerabilities ## 2. RISK EVALUATION Exploitation of these vulnerabilities could lead to denial-of-service, crashing t

Red Hat

kernel: netfilter: nfnetlink_osf: uninitialized variable information disclosure vulnerability

vendor_redhat·2022-09-22·CVSS 4.4

CVE-2022-42432 [MEDIUM] CWE-457 kernel: netfilter: nfnetlink_osf: uninitialized variable information disclosure vulnerability kernel: netfilter: nfnetlink_osf: uninitialized variable information disclosure vulnerability This vulnerability allows local attackers to disclose sensitive information on affected installations of the Linux Kernel 6.0-rc2. An attacker must first obtain the ability to execute high-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the nft_osf_eval function. The issue results from the lack of proper initialization of memory prior to accessing it. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the kernel. Was ZDI-CAN-18540. A flaw was found in the nft_osf_eval function in the netfilter subsystem of the Linux kernel. This issue results from the lack of proper initi

Debian

CVE-2022-42432: linux - This vulnerability allows local attackers to disclose sensitive information on a...

vendor_debian·2022·CVSS 4.4

CVE-2022-42432 [MEDIUM] CVE-2022-42432: linux - This vulnerability allows local attackers to disclose sensitive information on a... This vulnerability allows local attackers to disclose sensitive information on affected installations of the Linux Kernel 6.0-rc2. An attacker must first obtain the ability to execute high-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the nft_osf_eval function. The issue results from the lack of proper initialization of memory prior to accessing it. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the kernel. Was ZDI-CAN-18540. Scope: local bookworm: resolved (fixed in 6.0.2-1) bullseye: resolved (fixed in 5.10.148-1) forky: resolved (fixed in 6.0.2-1) sid: resolved (fixed in 6.0.2-1) trixie: resolved (fixed in 6.0.2-1)

OSV

CVE-2022-42432: This vulnerability allows local attackers to disclose sensitive information on affected installations of the Linux Kernel 6

osv·2023-03-29·CVSS 4.4

CVE-2022-42432 [MEDIUM] CVE-2022-42432: This vulnerability allows local attackers to disclose sensitive information on affected installations of the Linux Kernel 6 This vulnerability allows local attackers to disclose sensitive information on affected installations of the Linux Kernel 6.0-rc2. An attacker must first obtain the ability to execute high-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the nft_osf_eval function. The issue results from the lack of proper initialization of memory prior to accessing it. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the kernel. Was ZDI-CAN-18540.

GHSA

GHSA-6fx6-mv6x-h475: This vulnerability allows local attackers to disclose sensitive information on affected installations of the Linux Kernel 6

ghsa_unreviewed·2023-03-29

CVE-2022-42432 [MEDIUM] CWE-457 GHSA-6fx6-mv6x-h475: This vulnerability allows local attackers to disclose sensitive information on affected installations of the Linux Kernel 6 This vulnerability allows local attackers to disclose sensitive information on affected installations of the Linux Kernel 6.0-rc2. An attacker must first obtain the ability to execute high-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the nft_osf_eval function. The issue results from the lack of proper initialization of memory prior to accessing it. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the kernel. Was ZDI-CAN-18540.

CVE-2022-42432: This vulnerability allows local attackers to disclose sensitive information on affected installations of the Linux Kernel 6.0-rc2. An attacker must first…

Affected

CVSS provenance