Vulnerability-Lookup

CVE-2022-41858 (GCVE-0-2022-41858)

Vulnerability from cvelistv5 – Published: 2023-01-17 00:00 – Updated: 2025-04-07 16:46

Summary

A flaw was found in the Linux kernel. A NULL pointer dereference may occur while a slip driver is in progress to detach in sl_tx_timeout in drivers/net/slip/slip.c. This issue could allow an attacker to crash the system or leak internal kernel information.

Severity

7.1 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-04-07 16:46 UTC

CWE

CWE-416

Assigner

redhat redhat root

References

2 references

URL	Tags
https://github.com/torvalds/linux/commit/ec4eb8a8…
https://security.netapp.com/advisory/ntap-2023022…

Impacted products

1 product

Vendor	Product	Version	CPE status
n/a	Linux kernel	Affected: unknown

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T12:56:38.264Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/torvalds/linux/commit/ec4eb8a86ade4d22633e1da2a7d85a846b7d1798"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20230223-0006/"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 7.1,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "NONE",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2022-41858",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-04-07T16:46:04.627051Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-04-07T16:46:38.678Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Linux kernel",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A flaw was found in the Linux kernel. A NULL pointer dereference may occur while a slip driver is in progress to detach in sl_tx_timeout in drivers/net/slip/slip.c. This issue could allow an attacker to crash the system or leak internal kernel information."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-416",
              "description": "CWE-416",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-02-23T00:00:00.000Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "url": "https://github.com/torvalds/linux/commit/ec4eb8a86ade4d22633e1da2a7d85a846b7d1798"
        },
        {
          "url": "https://security.netapp.com/advisory/ntap-20230223-0006/"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2022-41858",
    "datePublished": "2023-01-17T00:00:00.000Z",
    "dateReserved": "2022-09-30T00:00:00.000Z",
    "dateUpdated": "2025-04-07T16:46:38.678Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2022-41858",
      "date": "2026-09-19",
      "epss": "0.00275",
      "percentile": "0.20159"
    },
    "fkie_nvd": {
      "configurations": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "matchCriteriaId": "C86EFD13-93D4-4385-83E8-C665BE8F570F",
                  "versionEndExcluding": "4.9.311",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "matchCriteriaId": "6D9B028C-6313-47F9-94B7-5F8122345E49",
                  "versionEndExcluding": "4.14.276",
                  "versionStartIncluding": "4.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "matchCriteriaId": "712D9B45-4B53-4563-94B5-F758AFBBFB0D",
                  "versionEndExcluding": "4.19.239",
                  "versionStartIncluding": "4.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "matchCriteriaId": "E0ADBA6D-47D8-4518-8D10-9B9196DE680B",
                  "versionEndExcluding": "5.4.190",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "matchCriteriaId": "40432B48-1E9D-48AE-9C76-22177FC744F8",
                  "versionEndExcluding": "5.10.112",
                  "versionStartIncluding": "5.5.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "matchCriteriaId": "05ABCC3F-88A9-47F9-9D40-8665747B2E43",
                  "versionEndExcluding": "5.15.35",
                  "versionStartIncluding": "5.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "matchCriteriaId": "E22C86CB-06CD-4D16-AB2A-F21EE8199262",
                  "versionEndExcluding": "5.17.4",
                  "versionStartIncluding": "5.16",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        },
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:netapp:hci_baseboard_management_controller:h300s:*:*:*:*:*:*:*",
                  "matchCriteriaId": "27227B35-932A-4035-B39F-6A455753C0D6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:netapp:hci_baseboard_management_controller:h410c:*:*:*:*:*:*:*",
                  "matchCriteriaId": "489D20B9-166F-423D-8C48-A23D3026E33B",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:netapp:hci_baseboard_management_controller:h410s:*:*:*:*:*:*:*",
                  "matchCriteriaId": "A4AD592C-222D-4C6F-B176-8145A1A5AFEC",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:netapp:hci_baseboard_management_controller:h500s:*:*:*:*:*:*:*",
                  "matchCriteriaId": "8603654B-A8A9-4DEB-B0DD-C82E1C885749",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:netapp:hci_baseboard_management_controller:h700s:*:*:*:*:*:*:*",
                  "matchCriteriaId": "C855C933-F271-45E6-8E85-8D7CF2EF1BE6",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A flaw was found in the Linux kernel. A NULL pointer dereference may occur while a slip driver is in progress to detach in sl_tx_timeout in drivers/net/slip/slip.c. This issue could allow an attacker to crash the system or leak internal kernel information."
        },
        {
          "lang": "es",
          "value": "Se encontr\u00f3 una falla en el kernel de Linux. Puede ocurrir una desreferencia de puntero NULL mientras un controlador de deslizamiento est\u00e1 en progreso para desconectarse en sl_tx_timeout en drivers/net/slip/slip.c. Este problema podr\u00eda permitir que un atacante bloquee el sistema o filtre informaci\u00f3n interna del kernel."
        }
      ],
      "id": "CVE-2022-41858",
      "lastModified": "2024-11-21T07:23:57.000",
      "metrics": {
        "cvssMetricV31": [
          {
            "cvssData": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 7.1,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "NONE",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
              "version": "3.1"
            },
            "exploitabilityScore": 1.8,
            "impactScore": 5.2,
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      },
      "published": "2023-01-17T18:15:11.140",
      "references": [
        {
          "source": "secalert@redhat.com",
          "tags": [
            "Patch",
            "Third Party Advisory"
          ],
          "url": "https://github.com/torvalds/linux/commit/ec4eb8a86ade4d22633e1da2a7d85a846b7d1798"
        },
        {
          "source": "secalert@redhat.com",
          "tags": [
            "Third Party Advisory"
          ],
          "url": "https://security.netapp.com/advisory/ntap-20230223-0006/"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "tags": [
            "Patch",
            "Third Party Advisory"
          ],
          "url": "https://github.com/torvalds/linux/commit/ec4eb8a86ade4d22633e1da2a7d85a846b7d1798"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "tags": [
            "Third Party Advisory"
          ],
          "url": "https://security.netapp.com/advisory/ntap-20230223-0006/"
        }
      ],
      "sourceIdentifier": "secalert@redhat.com",
      "vulnStatus": "Modified",
      "weaknesses": [
        {
          "description": [
            {
              "lang": "en",
              "value": "CWE-416"
            }
          ],
          "source": "secalert@redhat.com",
          "type": "Secondary"
        },
        {
          "description": [
            {
              "lang": "en",
              "value": "CWE-476"
            }
          ],
          "source": "nvd@nist.gov",
          "type": "Primary"
        }
      ]
    },
    "microsoft_vex": {
      "current_release_date": "2023-01-24T00:00:00.000Z",
      "cve": "CVE-2022-41858",
      "id": "msrc_CVE-2022-41858",
      "initial_release_date": "2023-01-04T00:00:00.000Z",
      "product_status:fixed": "2",
      "product_status:known_affected": "2",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "A flaw was found in the Linux kernel. A NULL pointer dereference may occur while a slip driver is in progress to detach in sl_tx_timeout in drivers/net/slip/slip.c. This issue could allow an attacker to crash the system or leak internal kernel information.",
      "url": "https://msrc.microsoft.com/csaf/vex/2023/msrc_cve-2022-41858.json",
      "version": "1"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "product": "Linux kernel",
                "vendor": "n/a",
                "versions": [
                  {
                    "status": "affected",
                    "version": "unknown"
                  }
                ]
              }
            ],
            "source": "secalert@redhat.com"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "C86EFD13-93D4-4385-83E8-C665BE8F570F",
                    "versionEndExcluding": "4.9.311",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "6D9B028C-6313-47F9-94B7-5F8122345E49",
                    "versionEndExcluding": "4.14.276",
                    "versionStartIncluding": "4.10",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "712D9B45-4B53-4563-94B5-F758AFBBFB0D",
                    "versionEndExcluding": "4.19.239",
                    "versionStartIncluding": "4.15",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "E0ADBA6D-47D8-4518-8D10-9B9196DE680B",
                    "versionEndExcluding": "5.4.190",
                    "versionStartIncluding": "4.20",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "40432B48-1E9D-48AE-9C76-22177FC744F8",
                    "versionEndExcluding": "5.10.112",
                    "versionStartIncluding": "5.5.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "05ABCC3F-88A9-47F9-9D40-8665747B2E43",
                    "versionEndExcluding": "5.15.35",
                    "versionStartIncluding": "5.11",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "E22C86CB-06CD-4D16-AB2A-F21EE8199262",
                    "versionEndExcluding": "5.17.4",
                    "versionStartIncluding": "5.16",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          },
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:a:netapp:hci_baseboard_management_controller:h300s:*:*:*:*:*:*:*",
                    "matchCriteriaId": "27227B35-932A-4035-B39F-6A455753C0D6",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:netapp:hci_baseboard_management_controller:h410c:*:*:*:*:*:*:*",
                    "matchCriteriaId": "489D20B9-166F-423D-8C48-A23D3026E33B",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:netapp:hci_baseboard_management_controller:h410s:*:*:*:*:*:*:*",
                    "matchCriteriaId": "A4AD592C-222D-4C6F-B176-8145A1A5AFEC",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:netapp:hci_baseboard_management_controller:h500s:*:*:*:*:*:*:*",
                    "matchCriteriaId": "8603654B-A8A9-4DEB-B0DD-C82E1C885749",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:netapp:hci_baseboard_management_controller:h700s:*:*:*:*:*:*:*",
                    "matchCriteriaId": "C855C933-F271-45E6-8E85-8D7CF2EF1BE6",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "A flaw was found in the Linux kernel. A NULL pointer dereference may occur while a slip driver is in progress to detach in sl_tx_timeout in drivers/net/slip/slip.c. This issue could allow an attacker to crash the system or leak internal kernel information."
          },
          {
            "lang": "es",
            "value": "Se encontr\u00f3 una falla en el kernel de Linux. Puede ocurrir una desreferencia de puntero NULL mientras un controlador de deslizamiento est\u00e1 en progreso para desconectarse en sl_tx_timeout en drivers/net/slip/slip.c. Este problema podr\u00eda permitir que un atacante bloquee el sistema o filtre informaci\u00f3n interna del kernel."
          }
        ],
        "id": "CVE-2022-41858",
        "lastModified": "2026-06-17T05:03:56.330",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.1,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "NONE",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.2,
              "source": "nvd@nist.gov",
              "type": "Primary"
            },
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.1,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "NONE",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.2,
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2022-41858",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-04-07T16:46:04.627051Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2023-01-17T18:15:11.140",
        "references": [
          {
            "source": "secalert@redhat.com",
            "tags": [
              "Patch",
              "Third Party Advisory"
            ],
            "url": "https://github.com/torvalds/linux/commit/ec4eb8a86ade4d22633e1da2a7d85a846b7d1798"
          },
          {
            "source": "secalert@redhat.com",
            "tags": [
              "Third Party Advisory"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20230223-0006/"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Patch",
              "Third Party Advisory"
            ],
            "url": "https://github.com/torvalds/linux/commit/ec4eb8a86ade4d22633e1da2a7d85a846b7d1798"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Third Party Advisory"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20230223-0006/"
          }
        ],
        "sourceIdentifier": "secalert@redhat.com",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-416"
              }
            ],
            "source": "secalert@redhat.com",
            "type": "Secondary"
          },
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-476"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-06-28T07:58:33+00:00",
      "cve": "CVE-2022-41858",
      "id": "CVE-2022-41858",
      "initial_release_date": "2022-04-05T15:30:00+00:00",
      "product_status:fixed": "1350",
      "product_status:known_affected": "50",
      "product_status:known_not_affected": "15",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: null-ptr-deref vulnerabilities in sl_tx_timeout in drivers/net/slip",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2022/cve-2022-41858.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-02T02:09:47Z",
      "cve": "CVE-2022-41858",
      "id": "CVE-2022-41858",
      "initial_release_date": "2023-02-15T03:23:21Z",
      "product_status:known_affected": "267",
      "product_status:known_not_affected": "101",
      "product_status:recommended": "1562",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2022-41858",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2022-41858.json",
      "version": "49"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "providerMetadata": {
              "dateUpdated": "2024-08-03T12:56:38.264Z",
              "orgId": "af854a3a-2127-422b-91ae-364da2661108",
              "shortName": "CVE"
            },
            "references": [
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://github.com/torvalds/linux/commit/ec4eb8a86ade4d22633e1da2a7d85a846b7d1798"
              },
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://security.netapp.com/advisory/ntap-20230223-0006/"
              }
            ],
            "title": "CVE Program Container"
          },
          {
            "metrics": [
              {
                "cvssV3_1": {
                  "attackComplexity": "LOW",
                  "attackVector": "LOCAL",
                  "availabilityImpact": "HIGH",
                  "baseScore": 7.1,
                  "baseSeverity": "HIGH",
                  "confidentialityImpact": "HIGH",
                  "integrityImpact": "NONE",
                  "privilegesRequired": "LOW",
                  "scope": "UNCHANGED",
                  "userInteraction": "NONE",
                  "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
                  "version": "3.1"
                }
              },
              {
                "other": {
                  "content": {
                    "id": "CVE-2022-41858",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "total"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2025-04-07T16:46:04.627051Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2025-04-07T16:46:28.985Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "product": "Linux kernel",
              "vendor": "n/a",
              "versions": [
                {
                  "status": "affected",
                  "version": "unknown"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "A flaw was found in the Linux kernel. A NULL pointer dereference may occur while a slip driver is in progress to detach in sl_tx_timeout in drivers/net/slip/slip.c. This issue could allow an attacker to crash the system or leak internal kernel information."
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-416",
                  "description": "CWE-416",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2023-02-23T00:00:00.000Z",
            "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
            "shortName": "redhat"
          },
          "references": [
            {
              "url": "https://github.com/torvalds/linux/commit/ec4eb8a86ade4d22633e1da2a7d85a846b7d1798"
            },
            {
              "url": "https://security.netapp.com/advisory/ntap-20230223-0006/"
            }
          ]
        }
      },
      "cveMetadata": {
        "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "assignerShortName": "redhat",
        "cveId": "CVE-2022-41858",
        "datePublished": "2023-01-17T00:00:00.000Z",
        "dateReserved": "2022-09-30T00:00:00.000Z",
        "dateUpdated": "2025-04-07T16:46:38.678Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}

MSRC_CVE-2022-41858

Vulnerability from csaf_microsoft - Published: 2023-01-04 00:00 - Updated: 2023-01-24 00:00

Summary

Scope

1 vulnerability in this advisory, including CVE-2022-41858.

CVE-2022-41858

7.1 (High)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

Fixed: 2 products Known affected: 2 products

https://learn.microsoft.com/en-us/azure/azure-linux/tutoria…

Open the full advisory

NCSC-2025-0382

Vulnerability from csaf_ncscnl - Published: 2025-12-09 13:15 - Updated: 2025-12-09 13:15

Summary

Kwetsbaarheden verholpen in Siemens producten

Scope

124 vulnerabilities in this advisory, including CVE-2022-41858.

CVE-2022-41858

Multiple updates across various SUSE Linux Enterprise kernels addressed critical security vulnerabilities, including stack overflows, denial of service, memory leaks, and use-after-free issues, enhancing overall system stability and security.

7.1 (High)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

Known affected: 32 products

Open the full advisory

OESA-2022-2133 (CVE-2022-45934)

Vulnerability from osv_openeuler – Published: 2022-12-09 11:05 – Updated: 2026-08-06 11:05 – Source website

Summary

kernel security update

Details

The Linux Kernel, the operating system core itself.

Security Fix(es):

An issue was discovered in the Linux kernel through 6.0.10. l2cap_config_req in net/bluetooth/l2cap_core.c has an integer wraparound via L2CAP_CONF_REQ packets.(CVE-2022-45934)

There are null-ptr-deref vulnerabilities in drivers/net/slip of linux that allow attacker tocrash linux kernel by simulating slip network card from user-space of linux.[Root cause]When a slip driver is detaching, the slip_close() will act tocleanup necessary resources and sl->tty is set to NULL inslip_close(). Meanwhile, the packet we transmit is blocked,sl_tx_timeout() will be called. Although slip_close() andsl_tx_timeout() use sl->lock to synchronize, we don`t judgewhether sl-> tty equals to NULL in sl_tx_timeout() and thenull pointer dereference bug will happen.(Thread 1) | (Thread 2)| slip_close()| spin_lock_bh(& sl-> lock) sl-> tty = NULL //(1)sl_tx_timeout() | spin_unlock_bh(& sl->lock)spin_lock(& sl-> lock);tty_chars_in_buffer(sl-> tty)|if (tty-> ops-> ..) //(2)synchronize_rcu()We set NULL to sl-> tty in position (1) and dereference sl-> ttyin position (2).(CVE-2022-41858)

A use-after-free flaw was found in Linux kernel before 5.19.2. This issue occurs in cmd_hdl_filter in drivers/staging/rtl8712/rtl8712_cmd.c, allowing an attacker to launch a local denial of service attack and gain escalation of privileges.(CVE-2022-4095)

Severity

7.8 (High)


                    
                      CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References

URL

Type

	https://www.openeuler.org/en/security/safety-bull…	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2022-45934	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2022-41858	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2022-4095	ADVISORY

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "aarch64": [
          "bpftool-4.19.90-2212.1.0.0180.oe1.aarch64.rpm",
          "kernel-tools-4.19.90-2212.1.0.0180.oe1.aarch64.rpm",
          "perf-debuginfo-4.19.90-2212.1.0.0180.oe1.aarch64.rpm",
          "kernel-debuginfo-4.19.90-2212.1.0.0180.oe1.aarch64.rpm",
          "kernel-debugsource-4.19.90-2212.1.0.0180.oe1.aarch64.rpm",
          "perf-4.19.90-2212.1.0.0180.oe1.aarch64.rpm",
          "bpftool-debuginfo-4.19.90-2212.1.0.0180.oe1.aarch64.rpm",
          "python2-perf-4.19.90-2212.1.0.0180.oe1.aarch64.rpm",
          "kernel-4.19.90-2212.1.0.0180.oe1.aarch64.rpm",
          "python3-perf-4.19.90-2212.1.0.0180.oe1.aarch64.rpm",
          "python2-perf-debuginfo-4.19.90-2212.1.0.0180.oe1.aarch64.rpm",
          "kernel-source-4.19.90-2212.1.0.0180.oe1.aarch64.rpm",
          "kernel-tools-debuginfo-4.19.90-2212.1.0.0180.oe1.aarch64.rpm",
          "python3-perf-debuginfo-4.19.90-2212.1.0.0180.oe1.aarch64.rpm",
          "kernel-tools-devel-4.19.90-2212.1.0.0180.oe1.aarch64.rpm",
          "kernel-devel-4.19.90-2212.1.0.0180.oe1.aarch64.rpm"
        ],
        "src": [
          "kernel-4.19.90-2212.1.0.0180.oe1.src.rpm"
        ],
        "x86_64": [
          "python2-perf-4.19.90-2212.1.0.0180.oe1.x86_64.rpm",
          "kernel-tools-devel-4.19.90-2212.1.0.0180.oe1.x86_64.rpm",
          "kernel-devel-4.19.90-2212.1.0.0180.oe1.x86_64.rpm",
          "kernel-source-4.19.90-2212.1.0.0180.oe1.x86_64.rpm",
          "python2-perf-debuginfo-4.19.90-2212.1.0.0180.oe1.x86_64.rpm",
          "kernel-tools-4.19.90-2212.1.0.0180.oe1.x86_64.rpm",
          "perf-4.19.90-2212.1.0.0180.oe1.x86_64.rpm",
          "kernel-tools-debuginfo-4.19.90-2212.1.0.0180.oe1.x86_64.rpm",
          "kernel-debuginfo-4.19.90-2212.1.0.0180.oe1.x86_64.rpm",
          "python3-perf-4.19.90-2212.1.0.0180.oe1.x86_64.rpm",
          "bpftool-4.19.90-2212.1.0.0180.oe1.x86_64.rpm",
          "python3-perf-debuginfo-4.19.90-2212.1.0.0180.oe1.x86_64.rpm",
          "perf-debuginfo-4.19.90-2212.1.0.0180.oe1.x86_64.rpm",
          "kernel-4.19.90-2212.1.0.0180.oe1.x86_64.rpm",
          "bpftool-debuginfo-4.19.90-2212.1.0.0180.oe1.x86_64.rpm",
          "kernel-debugsource-4.19.90-2212.1.0.0180.oe1.x86_64.rpm"
        ]
      },
      "package": {
        "ecosystem": "openEuler:20.03-LTS-SP1",
        "name": "kernel",
        "purl": "pkg:rpm/openEuler/kernel\u0026distro=openEuler-20.03-LTS-SP1"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "4.19.90-2212.1.0.0180.oe1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "database_specific": {
    "severity": "High"
  },
  "details": "The Linux Kernel, the operating system core itself.\r\n\r\nSecurity Fix(es):\r\n\r\nAn issue was discovered in the Linux kernel through 6.0.10. l2cap_config_req in net/bluetooth/l2cap_core.c has an integer wraparound via L2CAP_CONF_REQ packets.(CVE-2022-45934)\n\nThere are null-ptr-deref vulnerabilities in drivers/net/slip of linux that allow attacker tocrash linux kernel by simulating slip network card from user-space of linux.[Root cause]When a slip driver is detaching, the slip_close() will act tocleanup necessary resources and sl-\u003etty is set to NULL inslip_close(). Meanwhile, the packet we transmit is blocked,sl_tx_timeout() will be called. Although slip_close() andsl_tx_timeout() use sl-\u003elock to synchronize, we don`t judgewhether sl-\u0026gt; tty equals to NULL in sl_tx_timeout() and thenull pointer dereference bug will happen.(Thread 1) | (Thread 2)| slip_close()| spin_lock_bh(\u0026amp; sl-\u0026gt; lock) sl-\u0026gt; tty = NULL //(1)sl_tx_timeout() | spin_unlock_bh(\u0026amp; sl-\u0026gt;lock)spin_lock(\u0026amp; sl-\u0026gt; lock);tty_chars_in_buffer(sl-\u0026gt; tty)|if (tty-\u0026gt; ops-\u0026gt; ..) //(2)synchronize_rcu()We set NULL to sl-\u0026gt; tty in position (1) and dereference sl-\u0026gt; ttyin position (2).(CVE-2022-41858)\n\nA use-after-free flaw was found in Linux kernel before 5.19.2. This issue occurs in cmd_hdl_filter in drivers/staging/rtl8712/rtl8712_cmd.c, allowing an attacker to launch a local denial of service attack and gain escalation of privileges.(CVE-2022-4095)",
  "id": "OESA-2022-2133",
  "modified": "2026-08-06T11:05:27Z",
  "published": "2022-12-09T11:05:27Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2022-2133"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-45934"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-41858"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-4095"
    }
  ],
  "schema_version": "1.7.2",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "kernel security update",
  "upstream": [
    "CVE-2022-45934",
    "CVE-2022-41858",
    "CVE-2022-4095"
  ]
}

OESA-2022-2134 (CVE-2022-45934)

Vulnerability from osv_openeuler – Published: 2022-12-09 11:05 – Updated: 2026-08-06 11:05 – Source website

Summary

kernel security update

Details

The Linux Kernel, the operating system core itself.

Security Fix(es):

An issue was discovered in the Linux kernel through 6.0.10. l2cap_config_req in net/bluetooth/l2cap_core.c has an integer wraparound via L2CAP_CONF_REQ packets.(CVE-2022-45934)

Severity

7.8 (High)


                    
                      CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References

URL

Type

	https://www.openeuler.org/en/security/safety-bull…	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2022-45934	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2022-41858	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2022-4095	ADVISORY

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "aarch64": [
          "perf-4.19.90-2212.1.0.0180.oe1.aarch64.rpm",
          "kernel-devel-4.19.90-2212.1.0.0180.oe1.aarch64.rpm",
          "kernel-tools-4.19.90-2212.1.0.0180.oe1.aarch64.rpm",
          "kernel-4.19.90-2212.1.0.0180.oe1.aarch64.rpm",
          "python2-perf-4.19.90-2212.1.0.0180.oe1.aarch64.rpm",
          "python3-perf-debuginfo-4.19.90-2212.1.0.0180.oe1.aarch64.rpm",
          "kernel-debugsource-4.19.90-2212.1.0.0180.oe1.aarch64.rpm",
          "python2-perf-debuginfo-4.19.90-2212.1.0.0180.oe1.aarch64.rpm",
          "bpftool-4.19.90-2212.1.0.0180.oe1.aarch64.rpm",
          "perf-debuginfo-4.19.90-2212.1.0.0180.oe1.aarch64.rpm",
          "kernel-tools-debuginfo-4.19.90-2212.1.0.0180.oe1.aarch64.rpm",
          "bpftool-debuginfo-4.19.90-2212.1.0.0180.oe1.aarch64.rpm",
          "kernel-debuginfo-4.19.90-2212.1.0.0180.oe1.aarch64.rpm",
          "kernel-tools-devel-4.19.90-2212.1.0.0180.oe1.aarch64.rpm",
          "python3-perf-4.19.90-2212.1.0.0180.oe1.aarch64.rpm",
          "kernel-source-4.19.90-2212.1.0.0180.oe1.aarch64.rpm"
        ],
        "src": [
          "kernel-4.19.90-2212.1.0.0180.oe1.src.rpm"
        ],
        "x86_64": [
          "python2-perf-debuginfo-4.19.90-2212.1.0.0180.oe1.x86_64.rpm",
          "kernel-4.19.90-2212.1.0.0180.oe1.x86_64.rpm",
          "bpftool-4.19.90-2212.1.0.0180.oe1.x86_64.rpm",
          "bpftool-debuginfo-4.19.90-2212.1.0.0180.oe1.x86_64.rpm",
          "kernel-debugsource-4.19.90-2212.1.0.0180.oe1.x86_64.rpm",
          "perf-4.19.90-2212.1.0.0180.oe1.x86_64.rpm",
          "python3-perf-4.19.90-2212.1.0.0180.oe1.x86_64.rpm",
          "kernel-tools-4.19.90-2212.1.0.0180.oe1.x86_64.rpm",
          "perf-debuginfo-4.19.90-2212.1.0.0180.oe1.x86_64.rpm",
          "kernel-debuginfo-4.19.90-2212.1.0.0180.oe1.x86_64.rpm",
          "kernel-source-4.19.90-2212.1.0.0180.oe1.x86_64.rpm",
          "kernel-tools-devel-4.19.90-2212.1.0.0180.oe1.x86_64.rpm",
          "python2-perf-4.19.90-2212.1.0.0180.oe1.x86_64.rpm",
          "kernel-devel-4.19.90-2212.1.0.0180.oe1.x86_64.rpm",
          "kernel-tools-debuginfo-4.19.90-2212.1.0.0180.oe1.x86_64.rpm",
          "python3-perf-debuginfo-4.19.90-2212.1.0.0180.oe1.x86_64.rpm"
        ]
      },
      "package": {
        "ecosystem": "openEuler:20.03-LTS-SP3",
        "name": "kernel",
        "purl": "pkg:rpm/openEuler/kernel\u0026distro=openEuler-20.03-LTS-SP3"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "4.19.90-2212.1.0.0180.oe1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "database_specific": {
    "severity": "High"
  },
  "details": "The Linux Kernel, the operating system core itself.\r\n\r\nSecurity Fix(es):\r\n\r\nAn issue was discovered in the Linux kernel through 6.0.10. l2cap_config_req in net/bluetooth/l2cap_core.c has an integer wraparound via L2CAP_CONF_REQ packets.(CVE-2022-45934)\n\nThere are null-ptr-deref vulnerabilities in drivers/net/slip of linux that allow attacker tocrash linux kernel by simulating slip network card from user-space of linux.[Root cause]When a slip driver is detaching, the slip_close() will act tocleanup necessary resources and sl-\u003etty is set to NULL inslip_close(). Meanwhile, the packet we transmit is blocked,sl_tx_timeout() will be called. Although slip_close() andsl_tx_timeout() use sl-\u003elock to synchronize, we don`t judgewhether sl-\u0026gt; tty equals to NULL in sl_tx_timeout() and thenull pointer dereference bug will happen.(Thread 1) | (Thread 2)| slip_close()| spin_lock_bh(\u0026amp; sl-\u0026gt; lock) sl-\u0026gt; tty = NULL //(1)sl_tx_timeout() | spin_unlock_bh(\u0026amp; sl-\u0026gt;lock)spin_lock(\u0026amp; sl-\u0026gt; lock);tty_chars_in_buffer(sl-\u0026gt; tty)|if (tty-\u0026gt; ops-\u0026gt; ..) //(2)synchronize_rcu()We set NULL to sl-\u0026gt; tty in position (1) and dereference sl-\u0026gt; ttyin position (2).(CVE-2022-41858)\n\nA use-after-free flaw was found in Linux kernel before 5.19.2. This issue occurs in cmd_hdl_filter in drivers/staging/rtl8712/rtl8712_cmd.c, allowing an attacker to launch a local denial of service attack and gain escalation of privileges.(CVE-2022-4095)",
  "id": "OESA-2022-2134",
  "modified": "2026-08-06T11:05:27Z",
  "published": "2022-12-09T11:05:27Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2022-2134"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-45934"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-41858"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-4095"
    }
  ],
  "schema_version": "1.7.2",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "kernel security update",
  "upstream": [
    "CVE-2022-45934",
    "CVE-2022-41858",
    "CVE-2022-4095"
  ]
}

OESA-2022-2162 (CVE-2022-4095)

Vulnerability from osv_openeuler – Published: 2022-12-30 11:05 – Updated: 2026-08-06 11:05 – Source website

Summary

kernel security update

Details

Security Fix(es):

There are null-ptr-deref vulnerabilities in drivers/net/slip of linux that allow attacker to crash linux kernel by simulating slip network card from user-space of linux.

[Root cause]

When a slip driver is detaching, the slip_close() will act to cleanup necessary resources and sl->tty is set to NULL in slip_close(). Meanwhile, the packet we transmit is blocked, sl_tx_timeout() will be called. Although slip_close() and sl_tx_timeout() use sl->lock to synchronize, we don`t judge whether sl->tty equals to NULL in sl_tx_timeout() and the null pointer dereference bug will happen.

We set NULL to sl->tty in position (1) and dereference sl->tty in position (2).

------------------------------------------(CVE-2022-41858)

A flaw was found in the Linux kernel's Layer 2 Tunneling Protocol (L2TP). A missing lock when clearing sk_user_data can lead to a race condition and NULL pointer dereference. A local user could use this flaw to potentially crash the system causing a denial of service.(CVE-2022-4129)

In (TBD) of (TBD), there is a possible way to corrupt kernel memory due to a use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-220738351References: Upstream kernel(CVE-2022-20568)

In l2cap_chan_put of l2cap_core, there is a possible use after free due to improper locking. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-165329981References: Upstream kernel(CVE-2022-20566)

Guests can trigger NIC interface reset/abort/crash via netback It is possible for a guest to trigger a NIC interface reset/abort/crash in a Linux based network backend by sending certain kinds of packets. It appears to be an (unwritten?) assumption in the rest of the Linux network stack that packet protocol headers are all contained within the linear section of the SKB and some NICs behave badly if this is not the case. This has been reported to occur with Cisco (enic) and Broadcom NetXtrem II BCM5780 (bnx2x) though it may be an issue with other NICs/drivers as well. In case the frontend is sending requests with split headers, netback will forward those violating above mentioned assumption to the networking core, resulting in said misbehavior.(CVE-2022-3643)

In verity_target of dm-verity-target.c, there is a possible way to modify read-only files due to a missing permission check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-234475629References: Upstream kernel(CVE-2022-20572)

A stack overflow flaw was found in the Linux kernel's SYSCTL subsystem in how a user changes certain kernel parameters and variables. This flaw allows a local user to crash or potentially escalate their privileges on the system.(CVE-2022-4378)

In drivers/media/dvb-core/dmxdev.c in the Linux kernel through 5.19.10, there is a use-after-free caused by refcount races, affecting dvb_demux_open and dvb_dmxdev_release.(CVE-2022-41218)

Guests can trigger deadlock in Linux netback driver T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] The patch for XSA-392 introduced another issue which might result in a deadlock when trying to free the SKB of a packet dropped due to the XSA-392 handling (CVE-2022-42328). Additionally when dropping packages for other reasons the same deadlock could occur in case of netpoll being active for the interface the xen-netback driver is connected to (CVE-2022-42329).(CVE-2022-42328)

An issue was discovered in the Linux kernel before 6.0.11. Missing validation of the number of channels in drivers/net/wireless/microchip/wilc1000/cfg80211.c in the WILC1000 wireless driver can trigger a heap-based buffer overflow when copying the list of operating channels from Wi-Fi management frames.(CVE-2022-47518)

An issue was discovered in the Linux kernel before 6.0.11. Missing validation of IEEE80211_P2P_ATTR_OPER_CHANNEL in drivers/net/wireless/microchip/wilc1000/cfg80211.c in the WILC1000 wireless driver can trigger an out-of-bounds write when parsing the channel list attribute from Wi-Fi management frames.(CVE-2022-47519)

An issue was discovered in the Linux kernel before 6.0.11. Missing offset validation in drivers/net/wireless/microchip/wilc1000/hif.c in the WILC1000 wireless driver can trigger an out-of-bounds read when parsing a Robust Security Network (RSN) information element from a Netlink packet.(CVE-2022-47520)

An issue was discovered in the Linux kernel before 6.0.11. Missing validation of IEEE80211_P2P_ATTR_CHANNEL_LIST in drivers/net/wireless/microchip/wilc1000/cfg80211.c in the WILC1000 wireless driver can trigger a heap-based buffer overflow when parsing the operating channel attribute from Wi-Fi management frames.(CVE-2022-47521)

An issue was discovered in the Linux kernel through 5.16-rc6. kfd_parse_subtype_iolink in drivers/gpu/drm/amd/amdkfd/kfd_crat.c lacks check of the return value of kmemdup().(CVE-2022-3108)

Severity

10.0 (Critical)


                    
                      CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

References

URL

Type

	https://www.openeuler.org/en/security/safety-bull…	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2022-4095	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2022-41858	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2022-4129	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2022-20568	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2022-20566	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2022-3643	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2022-20572	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2022-4378	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2022-41218	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2022-42328	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2022-42329	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2022-47518	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2022-47519	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2022-47520	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2022-47521	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2022-3108	ADVISORY

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "aarch64": [
          "kernel-headers-5.10.0-60.74.0.98.oe2203.aarch64.rpm",
          "kernel-tools-devel-5.10.0-60.74.0.98.oe2203.aarch64.rpm",
          "python3-perf-debuginfo-5.10.0-60.74.0.98.oe2203.aarch64.rpm",
          "bpftool-debuginfo-5.10.0-60.74.0.98.oe2203.aarch64.rpm",
          "perf-5.10.0-60.74.0.98.oe2203.aarch64.rpm",
          "python3-perf-5.10.0-60.74.0.98.oe2203.aarch64.rpm",
          "kernel-5.10.0-60.74.0.98.oe2203.aarch64.rpm",
          "kernel-debuginfo-5.10.0-60.74.0.98.oe2203.aarch64.rpm",
          "kernel-devel-5.10.0-60.74.0.98.oe2203.aarch64.rpm",
          "bpftool-5.10.0-60.74.0.98.oe2203.aarch64.rpm",
          "kernel-source-5.10.0-60.74.0.98.oe2203.aarch64.rpm",
          "kernel-tools-debuginfo-5.10.0-60.74.0.98.oe2203.aarch64.rpm",
          "kernel-tools-5.10.0-60.74.0.98.oe2203.aarch64.rpm",
          "perf-debuginfo-5.10.0-60.74.0.98.oe2203.aarch64.rpm",
          "kernel-debugsource-5.10.0-60.74.0.98.oe2203.aarch64.rpm"
        ],
        "src": [
          "kernel-5.10.0-60.74.0.98.oe2203.src.rpm"
        ],
        "x86_64": [
          "kernel-source-5.10.0-60.74.0.98.oe2203.x86_64.rpm",
          "kernel-debugsource-5.10.0-60.74.0.98.oe2203.x86_64.rpm",
          "kernel-debuginfo-5.10.0-60.74.0.98.oe2203.x86_64.rpm",
          "bpftool-5.10.0-60.74.0.98.oe2203.x86_64.rpm",
          "bpftool-debuginfo-5.10.0-60.74.0.98.oe2203.x86_64.rpm",
          "kernel-tools-devel-5.10.0-60.74.0.98.oe2203.x86_64.rpm",
          "python3-perf-debuginfo-5.10.0-60.74.0.98.oe2203.x86_64.rpm",
          "kernel-devel-5.10.0-60.74.0.98.oe2203.x86_64.rpm",
          "kernel-headers-5.10.0-60.74.0.98.oe2203.x86_64.rpm",
          "python3-perf-5.10.0-60.74.0.98.oe2203.x86_64.rpm",
          "kernel-tools-debuginfo-5.10.0-60.74.0.98.oe2203.x86_64.rpm",
          "kernel-tools-5.10.0-60.74.0.98.oe2203.x86_64.rpm",
          "perf-5.10.0-60.74.0.98.oe2203.x86_64.rpm",
          "perf-debuginfo-5.10.0-60.74.0.98.oe2203.x86_64.rpm",
          "kernel-5.10.0-60.74.0.98.oe2203.x86_64.rpm"
        ]
      },
      "package": {
        "ecosystem": "openEuler:22.03-LTS",
        "name": "kernel",
        "purl": "pkg:rpm/openEuler/kernel\u0026distro=openEuler-22.03-LTS"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "5.10.0-60.74.0.98.oe2203"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "database_specific": {
    "severity": "Critical"
  },
  "details": "\r\n\r\nSecurity Fix(es):\r\n\r\nA use-after-free flaw was found in Linux kernel before 5.19.2. This issue occurs in cmd_hdl_filter in drivers/staging/rtl8712/rtl8712_cmd.c, allowing an attacker to launch a local denial of service attack and gain escalation of privileges.(CVE-2022-4095)\r\n\r\nThere are null-ptr-deref vulnerabilities in drivers/net/slip of linux that allow attacker to\ncrash linux kernel by simulating slip network card from user-space of linux.\r\n\r\n------------------------------------------\r\n\r\n[Root cause]\r\n\r\nWhen a slip driver is detaching, the slip_close() will act to\ncleanup necessary resources and sl-\u0026gt;tty is set to NULL in\nslip_close(). Meanwhile, the packet we transmit is blocked,\nsl_tx_timeout() will be called. Although slip_close() and\nsl_tx_timeout() use sl-\u0026gt;lock to synchronize, we don`t judge\nwhether sl-\u0026gt;tty equals to NULL in sl_tx_timeout() and the\nnull pointer dereference bug will happen.\r\n\r\n(Thread 1) | (Thread 2)\n| slip_close()\n| spin_lock_bh(\u0026amp;sl-\u0026gt;lock)\n| ...\n... | sl-\u0026gt;tty = NULL //(1)\nsl_tx_timeout() | spin_unlock_bh(\u0026amp;sl-\u0026gt;lock)\nspin_lock(\u0026amp;sl-\u0026gt;lock); |\n... | ...\ntty_chars_in_buffer(sl-\u0026gt;tty)|\nif (tty-\u0026gt;ops-\u0026gt;..) //(2) |\n... | synchronize_rcu()\r\n\r\nWe set NULL to sl-\u0026gt;tty in position (1) and dereference sl-\u0026gt;tty\nin position (2).\r\n\r\n------------------------------------------(CVE-2022-41858)\r\n\r\nA flaw was found in the Linux kernel\u0026apos;s Layer 2 Tunneling Protocol (L2TP). A missing lock when clearing sk_user_data can lead to a race condition and NULL pointer dereference. A local user could use this flaw to potentially crash the system causing a denial of service.(CVE-2022-4129)\r\n\r\nIn (TBD) of (TBD), there is a possible way to corrupt kernel memory due to a use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-220738351References: Upstream kernel(CVE-2022-20568)\r\n\r\nIn l2cap_chan_put of l2cap_core, there is a possible use after free due to improper locking. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-165329981References: Upstream kernel(CVE-2022-20566)\r\n\r\nGuests can trigger NIC interface reset/abort/crash via netback It is possible for a guest to trigger a NIC interface reset/abort/crash in a Linux based network backend by sending certain kinds of packets. It appears to be an (unwritten?) assumption in the rest of the Linux network stack that packet protocol headers are all contained within the linear section of the SKB and some NICs behave badly if this is not the case. This has been reported to occur with Cisco (enic) and Broadcom NetXtrem II BCM5780 (bnx2x) though it may be an issue with other NICs/drivers as well. In case the frontend is sending requests with split headers, netback will forward those violating above mentioned assumption to the networking core, resulting in said misbehavior.(CVE-2022-3643)\r\n\r\nIn verity_target of dm-verity-target.c, there is a possible way to modify read-only files due to a missing permission check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-234475629References: Upstream kernel(CVE-2022-20572)\r\n\r\nA stack overflow flaw was found in the Linux kernel\u0026apos;s SYSCTL subsystem in how a user changes certain kernel parameters and variables. This flaw allows a local user to crash or potentially escalate their privileges on the system.(CVE-2022-4378)\n\nIn drivers/media/dvb-core/dmxdev.c in the Linux kernel through 5.19.10, there is a use-after-free caused by refcount races, affecting dvb_demux_open and dvb_dmxdev_release.(CVE-2022-41218)\n\nGuests can trigger deadlock in Linux netback driver T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] The patch for XSA-392 introduced another issue which might result in a deadlock when trying to free the SKB of a packet dropped due to the XSA-392 handling (CVE-2022-42328). Additionally when dropping packages for other reasons the same deadlock could occur in case of netpoll being active for the interface the xen-netback driver is connected to (CVE-2022-42329).(CVE-2022-42328)\n\nGuests can trigger deadlock in Linux netback driver T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] The patch for XSA-392 introduced another issue which might result in a deadlock when trying to free the SKB of a packet dropped due to the XSA-392 handling (CVE-2022-42328). Additionally when dropping packages for other reasons the same deadlock could occur in case of netpoll being active for the interface the xen-netback driver is connected to (CVE-2022-42329).(CVE-2022-42329)\n\nAn issue was discovered in the Linux kernel before 6.0.11. Missing validation of the number of channels in drivers/net/wireless/microchip/wilc1000/cfg80211.c in the WILC1000 wireless driver can trigger a heap-based buffer overflow when copying the list of operating channels from Wi-Fi management frames.(CVE-2022-47518)\n\nAn issue was discovered in the Linux kernel before 6.0.11. Missing validation of IEEE80211_P2P_ATTR_OPER_CHANNEL in drivers/net/wireless/microchip/wilc1000/cfg80211.c in the WILC1000 wireless driver can trigger an out-of-bounds write when parsing the channel list attribute from Wi-Fi management frames.(CVE-2022-47519)\n\nAn issue was discovered in the Linux kernel before 6.0.11. Missing offset validation in drivers/net/wireless/microchip/wilc1000/hif.c in the WILC1000 wireless driver can trigger an out-of-bounds read when parsing a Robust Security Network (RSN) information element from a Netlink packet.(CVE-2022-47520)\n\nAn issue was discovered in the Linux kernel before 6.0.11. Missing validation of IEEE80211_P2P_ATTR_CHANNEL_LIST in drivers/net/wireless/microchip/wilc1000/cfg80211.c in the WILC1000 wireless driver can trigger a heap-based buffer overflow when parsing the operating channel attribute from Wi-Fi management frames.(CVE-2022-47521)\n\nAn issue was discovered in the Linux kernel through 5.16-rc6. kfd_parse_subtype_iolink in drivers/gpu/drm/amd/amdkfd/kfd_crat.c lacks check of the return value of kmemdup().(CVE-2022-3108)",
  "id": "OESA-2022-2162",
  "modified": "2026-08-06T11:05:28Z",
  "published": "2022-12-30T11:05:28Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2022-2162"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-4095"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-41858"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-4129"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-20568"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-20566"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-3643"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-20572"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-4378"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-41218"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-42328"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-42329"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-47518"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-47519"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-47520"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-47521"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-3108"
    }
  ],
  "schema_version": "1.7.2",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "kernel security update",
  "upstream": [
    "CVE-2022-4095",
    "CVE-2022-41858",
    "CVE-2022-4129",
    "CVE-2022-20568",
    "CVE-2022-20566",
    "CVE-2022-3643",
    "CVE-2022-20572",
    "CVE-2022-4378",
    "CVE-2022-41218",
    "CVE-2022-42328",
    "CVE-2022-42329",
    "CVE-2022-47518",
    "CVE-2022-47519",
    "CVE-2022-47520",
    "CVE-2022-47521",
    "CVE-2022-3108"
  ]
}

RHSA-2024:0412

Vulnerability from csaf_redhat - Published: 2024-01-25 08:13 - Updated: 2026-08-25 14:46

Summary

Red Hat Security Advisory: kernel security and bug fix update

Severity

Important

Scope

52 vulnerabilities in this advisory, including CVE-2022-41858.

CVE-2022-41858

7.1 (High)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

Fixed: 129 products

https://access.redhat.com/errata/RHSA-2024:0412

Open the full advisory

RHSA-2024:0431

Vulnerability from csaf_redhat - Published: 2024-01-25 11:13 - Updated: 2026-08-25 14:46

Summary

Red Hat Security Advisory: kernel-rt security and bug fix update

Severity

Important

Scope

12 vulnerabilities in this advisory, including CVE-2022-41858.

CVE-2022-41858

7.1 (High)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

Fixed: 30 products

https://access.redhat.com/errata/RHSA-2024:0431

Open the full advisory

RHSA-2024:0432

Vulnerability from csaf_redhat - Published: 2024-01-25 11:15 - Updated: 2026-08-25 14:46

Summary

Red Hat Security Advisory: kernel security and bug fix update

Severity

Important

Scope

12 vulnerabilities in this advisory, including CVE-2022-41858.

CVE-2022-41858

7.1 (High)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

Fixed: 166 products

https://access.redhat.com/errata/RHSA-2024:0432

Open the full advisory

RHSA-2024:0439

Vulnerability from csaf_redhat - Published: 2024-01-25 09:43 - Updated: 2026-08-25 14:46

Summary

Red Hat Security Advisory: kernel-rt security update

Severity

Important

Scope

22 vulnerabilities in this advisory, including CVE-2022-41858.

CVE-2022-41858

7.1 (High)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

Fixed: 34 products

https://access.redhat.com/errata/RHSA-2024:0439

Open the full advisory

RHSA-2024:0448

Vulnerability from csaf_redhat - Published: 2024-01-25 09:45 - Updated: 2026-08-25 14:46

Summary

Red Hat Security Advisory: kernel security and bug fix update

Severity

Important

Scope

24 vulnerabilities in this advisory, including CVE-2022-41858.

CVE-2022-41858

7.1 (High)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

Fixed: 200 products Known not affected: 1 product

https://access.redhat.com/errata/RHSA-2024:0448

Open the full advisory

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2022-41858 (GCVE-0-2022-41858)

MSRC_CVE-2022-41858

NCSC-2025-0382

OESA-2022-2133 (CVE-2022-45934)

OESA-2022-2134 (CVE-2022-45934)

OESA-2022-2162 (CVE-2022-4095)

RHSA-2024:0412

RHSA-2024:0431

RHSA-2024:0432

RHSA-2024:0439

RHSA-2024:0448

Tags

Sightings

Nomenclature

Related by attack behaviour