CVE-2022-48863
published 2024-07-16CVE-2022-48863: In the Linux kernel, the following vulnerability has been resolved: mISDN: Fix memory leak in dsp_pipeline_build() dsp_pipeline_build() allocates dup pointer…
PriorityP418medium5.5CVSS 3.1
AVLACLPRLUINSUCNINAH
EPSS
0.25%
16.0th percentile
In the Linux kernel, the following vulnerability has been resolved:
mISDN: Fix memory leak in dsp_pipeline_build()
dsp_pipeline_build() allocates dup pointer by kstrdup(cfg),
but then it updates dup variable by strsep(&dup, "|").
As a result when it calls kfree(dup), the dup variable contains NULL.
Found by Linux Driver Verification project (linuxtesting.org) with SVACE.
Affected
16 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 5.16.18-1 (bookworm) | linux 5.16.18-1 (bookworm) |
| linux | linux | — | — |
| linux | linux | >= 960366cf8dbb3359afaca30cf7fdbf69a6d6dda7 < a3d5fcc6cf2ecbba5a269631092570aa285a24cb | a3d5fcc6cf2ecbba5a269631092570aa285a24cb |
| linux | linux | >= 960366cf8dbb3359afaca30cf7fdbf69a6d6dda7 < 7777b1f795af1bb43867375d8a776080111aae1b | 7777b1f795af1bb43867375d8a776080111aae1b |
| linux | linux | >= 960366cf8dbb3359afaca30cf7fdbf69a6d6dda7 < 640445d6fc059d4514ffea79eb4196299e0e2d0f | 640445d6fc059d4514ffea79eb4196299e0e2d0f |
| linux | linux | >= 960366cf8dbb3359afaca30cf7fdbf69a6d6dda7 < c6a502c2299941c8326d029cfc8a3bc8a4607ad5 | c6a502c2299941c8326d029cfc8a3bc8a4607ad5 |
| linux | linux_kernel | >= 0 < 5.10.106-1 | 5.10.106-1 |
| linux | linux_kernel | >= 0 < 5.16.18-1 | 5.16.18-1 |
| linux | linux_kernel | >= 0 < 5.16.18-1 | 5.16.18-1 |
| linux | linux_kernel | >= 0 < 5.16.18-1 | 5.16.18-1 |
| linux | linux_kernel | >= 0 < 5.4.0-196.216 | 5.4.0-196.216 |
| linux | linux_kernel | >= 0 < 4.4.0-259.293 | 4.4.0-259.293 |
| linux | linux_kernel | >= 0 < 4.15.0-229.241 | 4.15.0-229.241 |
| linux | linux_kernel | >= 2.6.27 < 5.10.106 | 5.10.106 |
| linux | linux_kernel | >= 5.11 < 5.15.29 | 5.15.29 |
| linux | linux_kernel | >= 5.16 < 5.16.15 | 5.16.15 |
CVSS provenance
nvdv3.15.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
osv5.5MEDIUM
vendor_ubuntu6.3MEDIUM
vendor_debian5.5MEDIUM
vendor_redhat5.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
linux-iot vulnerabilities
osv·2024-11-19·CVSS 5.5
CVE-2022-36402 [MEDIUM] linux-iot vulnerabilities
linux-iot vulnerabilities
Ziming Zhang discovered that the VMware Virtual GPU DRM driver in the Linux
kernel contained an integer overflow vulnerability. A local attacker could
use this to cause a denial of service (system crash). (CVE-2022-36402)
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- ARM64 architecture;
- PowerPC architecture;
- User-Mode Linux (UML);
- x86 architecture;
- Block layer subsystem;
- Cryptographic API;
- Android drivers;
- Serial ATA and Parallel ATA drivers;
- ATM drivers;
- Drivers core;
- CPU frequency scaling framework;
- Device frequency scaling framework;
- GPU drivers;
- HID subsystem;
- Hardware monitoring drivers;
- Infini
OSV
linux-azure vulnerabilities
osv·2024-10-17·CVSS 5.5
[MEDIUM] linux-azure vulnerabilities
linux-azure vulnerabilities
It was discovered that the JFS file system contained an out-of-bounds read
vulnerability when printing xattr debug information. A local attacker could
use this to cause a denial of service (system crash).
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- GPU drivers;
- Greybus drivers;
- Modular ISDN driver;
- Multiple devices driver;
- Network drivers;
- SCSI drivers;
- VFIO drivers;
- F2FS file system;
- GFS2 file system;
- JFS file system;
- NILFS2 file system;
- Kernel debugger infrastructure;
- Bluetooth subsystem;
- IPv4 networking;
- L2TP protocol;
- Netfilter;
- RxRPC session sockets;
(CVE-2024-42154, CVE-2023-52527, CVE-2
OSV
linux-raspi-5.4 vulnerabilities
osv·2024-10-10·CVSS 5.5
CVE-2021-47188 [MEDIUM] linux-raspi-5.4 vulnerabilities
linux-raspi-5.4 vulnerabilities
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- GPU drivers;
- Modular ISDN driver;
- MMC subsystem;
- SCSI drivers;
- F2FS file system;
- GFS2 file system;
- Netfilter;
- RxRPC session sockets;
- Integrity Measurement Architecture(IMA) framework;
(CVE-2021-47188, CVE-2024-39494, CVE-2022-48791, CVE-2022-48863,
CVE-2024-42228, CVE-2024-38570, CVE-2024-42160, CVE-2024-26787,
CVE-2024-27012, CVE-2024-26677)
OSV
linux-raspi vulnerabilities
osv·2024-10-01·CVSS 5.5
CVE-2021-47188 [MEDIUM] linux-raspi vulnerabilities
linux-raspi vulnerabilities
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- GPU drivers;
- Modular ISDN driver;
- MMC subsystem;
- SCSI drivers;
- F2FS file system;
- GFS2 file system;
- Netfilter;
- RxRPC session sockets;
- Integrity Measurement Architecture(IMA) framework;
(CVE-2021-47188, CVE-2024-42160, CVE-2024-42228, CVE-2022-48863,
CVE-2024-26677, CVE-2024-26787, CVE-2024-38570, CVE-2024-39494,
CVE-2022-48791, CVE-2024-27012)
OSV
linux, linux-aws, linux-kvm, linux-lts-xenial vulnerabilities
osv·2024-09-26·CVSS 5.5
[MEDIUM] linux, linux-aws, linux-kvm, linux-lts-xenial vulnerabilities
linux, linux-aws, linux-kvm, linux-lts-xenial vulnerabilities
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- GPU drivers;
- Input Device (Tablet) drivers;
- Modular ISDN driver;
- Multiple devices driver;
- Network drivers;
- Near Field Communication (NFC) drivers;
- SCSI drivers;
- GCT GDM724x LTE driver;
- USB subsystem;
- VFIO drivers;
- GFS2 file system;
- JFS file system;
- NILFS2 file system;
- Networking core;
- IPv4 networking;
- L2TP protocol;
- Netfilter;
- RxRPC session sockets;
(CVE-2024-26651, CVE-2024-38583, CVE-2023-52527, CVE-2024-26880,
CVE-2022-48850, CVE-2024-26733, CVE-2021-47188, CVE-2024-42154,
CVE-2023-52809, CVE-2024-42228, CVE-2022
OSV
linux, linux-aws, linux-aws-hwe, linux-azure, linux-azure-4.15, linux-gcp, linux-gcp-4.15, linux-hwe, linux-kvm, linux-oracle vulnerabilities
osv·2024-09-23·CVSS 5.5
[MEDIUM] linux, linux-aws, linux-aws-hwe, linux-azure, linux-azure-4.15, linux-gcp, linux-gcp-4.15, linux-hwe, linux-kvm, linux-oracle vulnerabilities
linux, linux-aws, linux-aws-hwe, linux-azure, linux-azure-4.15, linux-gcp, linux-gcp-4.15, linux-hwe, linux-kvm, linux-oracle vulnerabilities
It was discovered that the JFS file system contained an out-of-bounds read
vulnerability when printing xattr debug information. A local attacker could
use this to cause a denial of service (system crash).
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- GPU drivers;
- Greybus drivers;
- Modular ISDN driver;
- Multiple devices driver;
- Network drivers;
- SCSI drivers;
- VFIO drivers;
- F2FS file system;
- GFS2 file system;
- JFS file system;
- NILFS2 file system;
- Kernel debugger infrastructure;
- Bluetooth subsystem
OSV
linux, linux-aws, linux-aws-5.4, linux-azure, linux-azure-5.4, linux-bluefield, linux-gcp, linux-gcp-5.4, linux-gkeop, linux-hwe-5.4, linux-ibm, linux-ibm-5.4, linux-kvm, linux-oracle, linux-oracle-5.
osv·2024-09-18·CVSS 5.5
[MEDIUM] linux, linux-aws, linux-aws-5.4, linux-azure, linux-azure-5.4, linux-bluefield, linux-gcp, linux-gcp-5.4, linux-gkeop, linux-hwe-5.4, linux-ibm, linux-ibm-5.4, linux-kvm, linux-oracle, linux-oracle-5.
linux, linux-aws, linux-aws-5.4, linux-azure, linux-azure-5.4, linux-bluefield, linux-gcp, linux-gcp-5.4, linux-gkeop, linux-hwe-5.4, linux-ibm, linux-ibm-5.4, linux-kvm, linux-oracle, linux-oracle-5.4, linux-xilinx-zynqmp vulnerabilities
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- GPU drivers;
- Modular ISDN driver;
- MMC subsystem;
- SCSI drivers;
- F2FS file system;
- GFS2 file system;
- Netfilter;
- RxRPC session sockets;
- Integrity Measurement Architecture(IMA) framework;
(CVE-2021-47188, CVE-2024-27012, CVE-2024-42228, CVE-2022-48791,
CVE-2024-39494, CVE-2022-48863, CVE-2024-26787, CVE-2024-42160,
CVE-2024-38570, CVE-2024-26677)
OSV
CVE-2022-48863: In the Linux kernel, the following vulnerability has been resolved: mISDN: Fix memory leak in dsp_pipeline_build() dsp_pipeline_build() allocates dup
osv·2024-07-16·CVSS 5.5
CVE-2022-48863 [MEDIUM] CVE-2022-48863: In the Linux kernel, the following vulnerability has been resolved: mISDN: Fix memory leak in dsp_pipeline_build() dsp_pipeline_build() allocates dup
In the Linux kernel, the following vulnerability has been resolved: mISDN: Fix memory leak in dsp_pipeline_build() dsp_pipeline_build() allocates dup pointer by kstrdup(cfg), but then it updates dup variable by strsep(&dup, "|"). As a result when it calls kfree(dup), the dup variable contains NULL. Found by Linux Driver Verification project (linuxtesting.org) with SVACE.
GHSA
GHSA-mr3g-8vqm-6mhq: In the Linux kernel, the following vulnerability has been resolved:
mISDN: Fix memory leak in dsp_pipeline_build()
dsp_pipeline_build() allocates du
ghsa_unreviewed·2024-07-16
CVE-2022-48863 [MEDIUM] CWE-401 GHSA-mr3g-8vqm-6mhq: In the Linux kernel, the following vulnerability has been resolved:
mISDN: Fix memory leak in dsp_pipeline_build()
dsp_pipeline_build() allocates du
In the Linux kernel, the following vulnerability has been resolved:
mISDN: Fix memory leak in dsp_pipeline_build()
dsp_pipeline_build() allocates dup pointer by kstrdup(cfg),
but then it updates dup variable by strsep(&dup, "|").
As a result when it calls kfree(dup), the dup variable contains NULL.
Found by Linux Driver Verification project (linuxtesting.org) with SVACE.
Ubuntu
Linux kernel (IoT) vulnerabilities
vendor_ubuntu·2024-11-19·CVSS 6.3
CVE-2024-46828 [MEDIUM] Linux kernel (IoT) vulnerabilities
Title: Linux kernel (IoT) vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
Ziming Zhang discovered that the VMware Virtual GPU DRM driver in the Linux
kernel contained an integer overflow vulnerability. A local attacker could
use this to cause a denial of service (system crash). (CVE-2022-36402)
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- ARM64 architecture;
- PowerPC architecture;
- User-Mode Linux (UML);
- x86 architecture;
- Block layer subsystem;
- Cryptographic API;
- Android drivers;
- Serial ATA and Parallel ATA drivers;
- ATM drivers;
- Drivers core;
- CPU frequency scaling framework;
- Device frequency scaling
Ubuntu
Linux kernel (Azure) vulnerabilities
vendor_ubuntu·2024-10-17·CVSS 5.5
CVE-2024-42154 [MEDIUM] Linux kernel (Azure) vulnerabilities
Title: Linux kernel (Azure) vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
It was discovered that the JFS file system contained an out-of-bounds read
vulnerability when printing xattr debug information. A local attacker could
use this to cause a denial of service (system crash).
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- GPU drivers;
- Greybus drivers;
- Modular ISDN driver;
- Multiple devices driver;
- Network drivers;
- SCSI drivers;
- VFIO drivers;
- F2FS file system;
- GFS2 file system;
- JFS file system;
- NILFS2 file system;
- Kernel debugger infrastructure;
- Bluetooth subsystem;
- IPv4 networking;
- L2TP prot
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2024-10-10·CVSS 5.5
CVE-2024-42160 [MEDIUM] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- GPU drivers;
- Modular ISDN driver;
- MMC subsystem;
- SCSI drivers;
- F2FS file system;
- GFS2 file system;
- Netfilter;
- RxRPC session sockets;
- Integrity Measurement Architecture(IMA) framework;
(CVE-2021-47188, CVE-2024-39494, CVE-2022-48791, CVE-2022-48863,
CVE-2024-42228, CVE-2024-38570, CVE-2024-42160, CVE-2024-26787,
CVE-2024-27012, CVE-2024-26677)
Instructions: After a standard system update you need to reboot your computer to make
all the necessary changes.
ATTENTION: Due to an unavoidable ABI ch
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2024-10-01·CVSS 5.5
CVE-2022-48863 [MEDIUM] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- GPU drivers;
- Modular ISDN driver;
- MMC subsystem;
- SCSI drivers;
- F2FS file system;
- GFS2 file system;
- Netfilter;
- RxRPC session sockets;
- Integrity Measurement Architecture(IMA) framework;
(CVE-2021-47188, CVE-2024-42160, CVE-2024-42228, CVE-2022-48863,
CVE-2024-26677, CVE-2024-26787, CVE-2024-38570, CVE-2024-39494,
CVE-2022-48791, CVE-2024-27012)
Instructions: After a standard system update you need to reboot your computer to make
all the necessary changes.
ATTENTION: Due to an unavoidable ABI ch
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2024-09-26·CVSS 5.5
CVE-2021-47188 [MEDIUM] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- GPU drivers;
- Input Device (Tablet) drivers;
- Modular ISDN driver;
- Multiple devices driver;
- Network drivers;
- Near Field Communication (NFC) drivers;
- SCSI drivers;
- GCT GDM724x LTE driver;
- USB subsystem;
- VFIO drivers;
- GFS2 file system;
- JFS file system;
- NILFS2 file system;
- Networking core;
- IPv4 networking;
- L2TP protocol;
- Netfilter;
- RxRPC session sockets;
(CVE-2024-26651, CVE-2024-38583, CVE-2023-52527, CVE-2024-26880,
CVE-2022-48850, CVE-2024-26733, CVE-2021-47188, CVE-2024-42154,
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2024-09-23·CVSS 5.5
CVE-2024-26880 [MEDIUM] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
It was discovered that the JFS file system contained an out-of-bounds read
vulnerability when printing xattr debug information. A local attacker could
use this to cause a denial of service (system crash).
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- GPU drivers;
- Greybus drivers;
- Modular ISDN driver;
- Multiple devices driver;
- Network drivers;
- SCSI drivers;
- VFIO drivers;
- F2FS file system;
- GFS2 file system;
- JFS file system;
- NILFS2 file system;
- Kernel debugger infrastructure;
- Bluetooth subsystem;
- IPv4 networking;
- L2TP protocol;
-
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2024-09-18·CVSS 5.5
CVE-2022-48863 [MEDIUM] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- GPU drivers;
- Modular ISDN driver;
- MMC subsystem;
- SCSI drivers;
- F2FS file system;
- GFS2 file system;
- Netfilter;
- RxRPC session sockets;
- Integrity Measurement Architecture(IMA) framework;
(CVE-2021-47188, CVE-2024-27012, CVE-2024-42228, CVE-2022-48791,
CVE-2024-39494, CVE-2022-48863, CVE-2024-26787, CVE-2024-42160,
CVE-2024-38570, CVE-2024-26677)
Instructions: After a standard system update you need to reboot your computer to make
all the necessary changes.
ATTENTION: Due to an unavoidable ABI ch
Red Hat
kernel: mISDN: Fix memory leak in dsp_pipeline_build()
vendor_redhat·2024-07-16·CVSS 5.5
CVE-2022-48863 [MEDIUM] CWE-401 kernel: mISDN: Fix memory leak in dsp_pipeline_build()
kernel: mISDN: Fix memory leak in dsp_pipeline_build()
In the Linux kernel, the following vulnerability has been resolved:
mISDN: Fix memory leak in dsp_pipeline_build()
dsp_pipeline_build() allocates dup pointer by kstrdup(cfg),
but then it updates dup variable by strsep(&dup, "|").
As a result when it calls kfree(dup), the dup variable contains NULL.
Found by Linux Driver Verification project (linuxtesting.org) with SVACE.
A vulnerability was found in the dsp_pipeline_build function in the Linux kernel's mISDN driver, which can cause a memory leak when the function allocates memory with kstrdup and subsequently modifies the pointer with strsep, leading to a scenario where kfree is called on a NULL pointer.
Mitigation: Mitigation for this issue is either not available or the currently
Debian
CVE-2022-48863: linux - In the Linux kernel, the following vulnerability has been resolved: mISDN: Fix ...
vendor_debian·2022·CVSS 5.5
CVE-2022-48863 [MEDIUM] CVE-2022-48863: linux - In the Linux kernel, the following vulnerability has been resolved: mISDN: Fix ...
In the Linux kernel, the following vulnerability has been resolved: mISDN: Fix memory leak in dsp_pipeline_build() dsp_pipeline_build() allocates dup pointer by kstrdup(cfg), but then it updates dup variable by strsep(&dup, "|"). As a result when it calls kfree(dup), the dup variable contains NULL. Found by Linux Driver Verification project (linuxtesting.org) with SVACE.
Scope: local
bookworm: resolved (fixed in 5.16.18-1)
bullseye: resolved (fixed in 5.10.106-1)
forky: resolved (fixed in 5.16.18-1)
sid: resolved (fixed in 5.16.18-1)
trixie: resolved (fixed in 5.16.18-1)
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://git.kernel.org/stable/c/640445d6fc059d4514ffea79eb4196299e0e2d0fhttps://git.kernel.org/stable/c/7777b1f795af1bb43867375d8a776080111aae1bhttps://git.kernel.org/stable/c/a3d5fcc6cf2ecbba5a269631092570aa285a24cbhttps://git.kernel.org/stable/c/c6a502c2299941c8326d029cfc8a3bc8a4607ad5https://git.kernel.org/stable/c/640445d6fc059d4514ffea79eb4196299e0e2d0fhttps://git.kernel.org/stable/c/7777b1f795af1bb43867375d8a776080111aae1bhttps://git.kernel.org/stable/c/a3d5fcc6cf2ecbba5a269631092570aa285a24cbhttps://git.kernel.org/stable/c/c6a502c2299941c8326d029cfc8a3bc8a4607ad5
2024-07-16
Published