CVSS: 5.5EPSS: 0%CPEs: 2EXPL: 0CVE-2022-42329
https://notcve.org/view.php?id=CVE-2022-42329
Guests can trigger deadlock in Linux netback driver T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] The patch for XSA-392 introduced another issue which might result in a deadlock when trying to free the SKB of a packet dropped due to the XSA-392 handling (CVE-2022-42328). Additionally when dropping packages for other reasons the same deadlock could occur in case of netpoll being active for the interface the xen-netback driver is connected to (CVE-2022-42329). Los invitados pueden provocar un punto muerto en Linux netback driver T. Este registro de información CNA se relaciona con múltiples CVE; el texto explica qué aspectos/vulnerabilidades corresponden a cada CVE.] • http://www.openwall.com/lists/oss-security/2022/12/08/2 http://www.openwall.com/lists/oss-security/2022/12/08/3 http://www.openwall.com/lists/oss-security/2022/12/09/2 https://lists.debian.org/debian-lts-announce/2022/12/msg00031.html https://lists.debian.org/debian-lts-announce/2022/12/msg00034.html https://xenbits.xenproject.org/xsa/advisory-424.txt • CWE-667: Improper Locking •
CVSS: 5.5EPSS: 0%CPEs: 1EXPL: 0CVE-2022-4269 – kernel: net: CPU soft lockup in TC mirred egress-to-ingress action
https://notcve.org/view.php?id=CVE-2022-4269
A flaw was found in the Linux kernel Traffic Control (TC) subsystem. Using a specific networking configuration (redirecting egress packets to ingress using TC action "mirred") a local unprivileged user could trigger a CPU soft lockup (ABBA deadlock) when the transport protocol in use (TCP or SCTP) does a retransmission, resulting in a denial of service condition. Se encontró un fallo en el subsistema de control de tráfico (TC) del kernel de Linux. Usando una configuración de red específica (redireccionando paquetes de salida para ingresar usando la acción TC "mirred"), un usuario local sin privilegios podría desencadenar un bloqueo suave de la CPU (bloqueo ABBA) cuando el protocolo de transporte en uso (TCP o SCTP) realiza una retransmisión, lo que resulta en una condición de denegación de servicio. • https://lists.debian.org/debian-lts-announce/2023/10/msg00027.html https://lore.kernel.org/netdev/33dc43f587ec1388ba456b4915c75f02a8aae226.1663945716.git.dcaratti%40redhat.com https://security.netapp.com/advisory/ntap-20230929-0001 https://www.debian.org/security/2023/dsa-5480 https://access.redhat.com/security/cve/CVE-2022-4269 https://bugzilla.redhat.com/show_bug.cgi?id=2150272 • CWE-833: Deadlock •
CVSS: 5.5EPSS: 0%CPEs: 7EXPL: 1CVE-2022-45869 – kernel: KVM: x86/mmu: race condition in direct_page_fault()
https://notcve.org/view.php?id=CVE-2022-45869
A race condition in the x86 KVM subsystem in the Linux kernel through 6.1-rc6 allows guest OS users to cause a denial of service (host OS crash or host OS memory corruption) when nested virtualisation and the TDP MMU are enabled. Una condición de carrera en el subsistema KVM x86 en el kernel de Linux hasta 6.1-rc6 permite a los usuarios del sistema operativo invitado provocar una denegación de servicio (caída del sistema operativo anfitrión o corrupción de la memoria del sistema operativo anfitrión) cuando la virtualización anidada y la MMU TDP están habilitadas. A flaw was found in the Linux kernel in the KVM. A race condition in direct_page_fault allows guest OS users to cause a denial of service (host OS crash or host OS memory corruption) when nested virtualization and the TDP MMU are enabled. • https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=47b0c2e4c220f2251fd8dcfbb44479819c715e15 https://access.redhat.com/security/cve/CVE-2022-45869 https://bugzilla.redhat.com/show_bug.cgi?id=2151317 • CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') •
CVSS: 5.5EPSS: 0%CPEs: 1EXPL: 0CVE-2022-4127
https://notcve.org/view.php?id=CVE-2022-4127
A NULL pointer dereference issue was discovered in the Linux kernel in io_files_update_with_index_alloc. A local user could use this flaw to potentially crash the system causing a denial of service. Se descubrió un problema de desreferencia de puntero NULL en el kernel de Linux en io_files_update_with_index_alloc. Un usuario local podría utilizar esta falla para bloquear potencialmente el sistema y provocar una Denegación de Servicio (DoS). • https://github.com/torvalds/linux/commit/d785a773bed966a75ca1f11d108ae1897189975b https://lore.kernel.org/all/d5a19c1e-9968-e22e-5917-c3139c5e7e89%40kernel.dk • CWE-476: NULL Pointer Dereference •
CVSS: 7.0EPSS: 0%CPEs: 17EXPL: 0CVE-2022-45919 – kernel: use-after-free due to race condition occurring in dvb_ca_en50221.c
https://notcve.org/view.php?id=CVE-2022-45919
An issue was discovered in the Linux kernel through 6.0.10. In drivers/media/dvb-core/dvb_ca_en50221.c, a use-after-free can occur is there is a disconnect after an open, because of the lack of a wait_event. Se descubrió un problema en el kernel de Linux hasta la versión 6.0.10. En drivers/media/dvb-core/dvb_ca_en50221.c, puede ocurrir un use-after-free si hay una desconexión después de una apertura, debido a la falta de un wait_event. A race condition flaw leading to a use-after-free issue was found in the Linux kernel media subsystem in the DVB CA EN50221 interface of the DVB core device driver. • https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=280a8ab81733da8bc442253c700a52c4c0886ffd https://lore.kernel.org/linux-media/20221121063308.GA33821%40ubuntu/T/#u https://security.netapp.com/advisory/ntap-20230113-0008 https://access.redhat.com/security/cve/CVE-2022-45919 https://bugzilla.redhat.com/show_bug.cgi?id=2151956 • CWE-416: Use After Free •