A flaw was found in the Linux kernel’s networking code. A use-after-free was found in the way the sch_sfb enqueue function used the socket buffer (SKB) cb field after the same SKB had been enqueued (and freed) into a child qdisc. This flaw allows a local, unprivileged user to crash the system, causing a denial of service.
References
| Link | Resource |
|---|---|
| https://github.com/torvalds/linux/commit/9efd23297cca | Patch Third Party Advisory |
| https://lists.debian.org/debian-lts-announce/2022/11/msg00001.html | Mailing List Third Party Advisory |
| https://www.zerodayinitiative.com/advisories/upcoming/ | Third Party Advisory VDB Entry |
Configurations
Configuration 1 (hide)
|
Configuration 2 (hide)
|
History
04 Nov 2022, 19:14
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* | |
| References |
|
21 Oct 2022, 12:59
| Type | Values Removed | Values Added |
|---|---|---|
| References | (MISC) https://github.com/torvalds/linux/commit/9efd23297cca - Patch, Third Party Advisory | |
| References | (MISC) https://www.zerodayinitiative.com/advisories/upcoming/ - Third Party Advisory, VDB Entry | |
| CPE | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:6.0:rc2:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:6.0:rc4:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:6.0:rc1:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:6.0:rc3:*:*:*:*:*:* |
|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 5.5 |
19 Oct 2022, 18:24
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2022-10-19 18:15
Updated : 2024-02-04 22:51
NVD link : CVE-2022-3586
Mitre link : CVE-2022-3586
CVE.ORG link : CVE-2022-3586
JSON object : View
Products Affected
debian
- debian_linux
linux
- linux_kernel
CWE
CWE-416
Use After Free