CVE-2022-2503

2022-08-1200:00:00

ubuntu.com

6.9 Medium

CVSS3

Attack Vector

LOCAL

Attack Complexity

HIGH

Privileges Required

HIGH

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:N

0.0005 Low

EPSS

Percentile

18.0%

JSON

Dm-verity is used for extending root-of-trust to root filesystems. LoadPin
builds on this property to restrict module/firmware loads to just the
trusted root filesystem. Device-mapper table reloads currently allow users
with root privileges to switch out the target with an equivalent dm-linear
target and bypass verification till reboot. This allows root to bypass
LoadPin and can be used to load untrusted and unverified kernel modules and
firmware, which implies arbitrary kernel execution and persistence for
peripherals that do not verify firmware updates. We recommend upgrading
past commit 4caae58406f8ceb741603eee460d79bacca9b1b5

OSVersionArchitecturePackageVersionFilename
ubuntu18.04noarchlinux< 4.15.0-191.202UNKNOWN
ubuntu20.04noarchlinux< 5.4.0-126.142UNKNOWN
ubuntu22.04noarchlinux< 5.15.0-47.51UNKNOWN
ubuntu16.04noarchlinux< 4.4.0-239.273UNKNOWN
ubuntu18.04noarchlinux-aws< 4.15.0-1139.150UNKNOWN
ubuntu20.04noarchlinux-aws< 5.4.0-1085.92UNKNOWN
ubuntu22.04noarchlinux-aws< 5.15.0-1019.23UNKNOWN
ubuntu14.04noarchlinux-aws< 4.4.0-1117.123UNKNOWN
ubuntu16.04noarchlinux-aws< 4.4.0-1155.170UNKNOWN
ubuntu20.04noarchlinux-aws-5.15< 5.15.0-1019.23~20.04.1UNKNOWN

OS	Version	Architecture	Package	Version	Filename
ubuntu	18.04	noarch	linux	< 4.15.0-191.202	UNKNOWN
ubuntu	20.04	noarch	linux	< 5.4.0-126.142	UNKNOWN
ubuntu	22.04	noarch	linux	< 5.15.0-47.51	UNKNOWN
ubuntu	16.04	noarch	linux	< 4.4.0-239.273	UNKNOWN
ubuntu	18.04	noarch	linux-aws	< 4.15.0-1139.150	UNKNOWN
ubuntu	20.04	noarch	linux-aws	< 5.4.0-1085.92	UNKNOWN
ubuntu	22.04	noarch	linux-aws	< 5.15.0-1019.23	UNKNOWN
ubuntu	14.04	noarch	linux-aws	< 4.4.0-1117.123	UNKNOWN
ubuntu	16.04	noarch	linux-aws	< 4.4.0-1155.170	UNKNOWN
ubuntu	20.04	noarch	linux-aws-5.15	< 5.15.0-1019.23~20.04.1	UNKNOWN