Ubuntu.comUB:CVE-2022-1729CVE-2022-1729
CVSS3
Attack Vector
LOCAL
Attack Complexity
HIGH
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS
Percentile
15.7%
A race condition was found the Linux kernel in perf_event_open() which can
be exploited by an unprivileged user to gain root privileges. The bug
allows to build several exploit primitives such as kernel address
information leak, arbitrary execution, etc.
Notes
| Author | Note |
|---|---|
| alexmurray | Ubuntu kernels enable SECURITY_PERF_EVENTS_RESTRICT which sets kernel.perf_event_paranoid >= 3 and so disables unprivileged users from using perf by default. As such in their default configuration, Ubuntu kernels are not able to be exploited by this flaw to achieve local privilege escalation. |
| OS | Version | Architecture | Package | Version | Filename |
|---|---|---|---|---|---|
| ubuntu | 18.04 | noarch | linux | <Â 4.15.0-191.202 | UNKNOWN |
| ubuntu | 20.04 | noarch | linux | <Â 5.4.0-126.142 | UNKNOWN |
| ubuntu | 22.04 | noarch | linux | <Â 5.15.0-47.51 | UNKNOWN |
| ubuntu | 16.04 | noarch | linux | <Â 4.4.0-234.268 | UNKNOWN |
| ubuntu | 18.04 | noarch | linux-aws | <Â 4.15.0-1139.150 | UNKNOWN |
| ubuntu | 20.04 | noarch | linux-aws | <Â 5.4.0-1085.92 | UNKNOWN |
| ubuntu | 22.04 | noarch | linux-aws | <Â 5.15.0-1019.23 | UNKNOWN |
| ubuntu | 14.04 | noarch | linux-aws | <Â 4.4.0-1113.119 | UNKNOWN |
| ubuntu | 16.04 | noarch | linux-aws | <Â 4.4.0-1151.166 | UNKNOWN |
| ubuntu | 20.04 | noarch | linux-aws-5.15 | <Â 5.15.0-1019.23~20.04.1 | UNKNOWN |
References
github.com/torvalds/linux/commit/3ac6487e584a1eb54071dbe1212e05b884136704
launchpad.net/bugs/cve/CVE-2022-1729
lore.kernel.org/all/[email protected]/T/#u
nvd.nist.gov/vuln/detail/CVE-2022-1729
security-tracker.debian.org/tracker/CVE-2022-1729
ubuntu.com/security/notices/USN-5560-1
ubuntu.com/security/notices/USN-5560-2
ubuntu.com/security/notices/USN-5594-1
ubuntu.com/security/notices/USN-5599-1
ubuntu.com/security/notices/USN-5602-1
ubuntu.com/security/notices/USN-5616-1
ubuntu.com/security/notices/USN-5622-1
ubuntu.com/security/notices/USN-5623-1
ubuntu.com/security/notices/USN-5630-1
ubuntu.com/security/notices/USN-5639-1
ubuntu.com/security/notices/USN-5647-1
ubuntu.com/security/notices/USN-5650-1
ubuntu.com/security/notices/USN-5654-1
ubuntu.com/security/notices/USN-5660-1
www.cve.org/CVERecord?id=CVE-2022-1729
www.openwall.com/lists/oss-security/2022/05/20/2
Related
CVSS3
Attack Vector
LOCAL
Attack Complexity
HIGH
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS
Percentile
15.7%