Lucene search

K
ubuntucveUbuntu.comUB:CVE-2022-42432
HistoryMar 29, 2023 - 12:00 a.m.

CVE-2022-42432

2023-03-2900:00:00
ubuntu.com
ubuntu.com
16
vulnerability
linux kernel
disclosure
sensitive information
arbitrary code
nft_osf_eval
memory initialization
zdi-can-18540
unix

4.4 Medium

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

0.0004 Low

EPSS

Percentile

16.1%

This vulnerability allows local attackers to disclose sensitive information
on affected installations of the Linux Kernel 6.0-rc2. An attacker must
first obtain the ability to execute high-privileged code on the target
system in order to exploit this vulnerability. The specific flaw exists
within the nft_osf_eval function. The issue results from the lack of proper
initialization of memory prior to accessing it. An attacker can leverage
this in conjunction with other vulnerabilities to execute arbitrary code in
the context of the kernel. Was ZDI-CAN-18540.

OSVersionArchitecturePackageVersionFilename
ubuntu20.04noarchlinux< 5.4.0-136.153UNKNOWN
ubuntu22.04noarchlinux< 5.15.0-57.63UNKNOWN
ubuntu22.10noarchlinux< 5.19.0-28.29UNKNOWN
ubuntu20.04noarchlinux-aws< 5.4.0-1093.101UNKNOWN
ubuntu22.04noarchlinux-aws< 5.15.0-1027.31UNKNOWN
ubuntu22.10noarchlinux-aws< 5.19.0-1016.17UNKNOWN
ubuntu20.04noarchlinux-aws-5.15< 5.15.0-1027.31~20.04.1UNKNOWN
ubuntu18.04noarchlinux-aws-5.4< 5.4.0-1093.102~18.04.2UNKNOWN
ubuntu20.04noarchlinux-azure< 5.4.0-1100.106UNKNOWN
ubuntu22.04noarchlinux-azure< 5.15.0-1030.37UNKNOWN
Rows per page:
1-10 of 511

4.4 Medium

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

0.0004 Low

EPSS

Percentile

16.1%