CVSS: 7.8EPSS: 0%CPEs: 9EXPL: 1CVE-2022-42720 – kernel: use-after-free in bss_ref_get in net/wireless/scan.c
https://notcve.org/view.php?id=CVE-2022-42720
Various refcounting bugs in the multi-BSS handling in the mac80211 stack in the Linux kernel 5.1 through 5.19.x before 5.19.16 could be used by local attackers (able to inject WLAN frames) to trigger use-after-free conditions to potentially execute code. Varios errores de recuento en el manejo de multi-BSS en la pila mac80211 en el kernel de Linux versiones 5.1 hasta 5.19.14, podrían ser usados por atacantes locales (capaces de inyectar tramas WLAN) para desencadenar condiciones de uso de memoria previamente liberada para potencialmente ejecutar código A use-after-free flaw was found in bss_ref_get in the net/wireless/scan.c in the Linux kernel. This issue can lead to a denial of service or arbitrary code execution. • http://packetstormsecurity.com/files/169951/Kernel-Live-Patch-Security-Notice-LSN-0090-1.html http://www.openwall.com/lists/oss-security/2022/10/13/5 https://bugzilla.suse.com/show_bug.cgi?id=1204059 https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless.git/commit/?id=0b7808818cb9df6680f98996b8e9a439fa7bcc2f https://lists.debian.org/debian-lts-announce/2022/11/msg00001.html https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GGHENNMLCWIQV2LLA56BJNFIUZ7WB4IY&# • CWE-416: Use After Free •
CVSS: 5.5EPSS: 0%CPEs: 1EXPL: 2CVE-2022-42703 – kernel: use-after-free related to leaf anon_vma double reuse
https://notcve.org/view.php?id=CVE-2022-42703
mm/rmap.c in the Linux kernel before 5.19.7 has a use-after-free related to leaf anon_vma double reuse. El archivo mm/rmap.c en el kernel de Linux versiones anteriores a 5.19.7, presenta un uso de memoria previamente liberada relacionado con un doble reúso de la hoja anon_vma A memory leak flaw with use-after-free capability was found in the Linux kernel. The VMA mm/rmap.c functionality in the is_mergeable_anon_vma() function continuously forks, using memory operations to trigger an incorrect reuse of leaf anon_vma. This issue allows a local attacker to crash the system. • https://bugs.chromium.org/p/project-zero/issues/detail?id=2351 https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.19.7 https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=2555283eb40df89945557273121e9393ef9b542b https://github.com/torvalds/linux/commit/2555283eb40df89945557273121e9393ef9b542b https://googleprojectzero.blogspot.com/2022/12/exploiting-CVE-2022-42703-bringing-back-the-stack-attack.html https://access.redhat.com/security/cve/CVE-2022-42703 https://bugzilla.redhat&# • CWE-416: Use After Free •
CVSS: 4.2EPSS: 0%CPEs: 1EXPL: 0CVE-2022-41848
https://notcve.org/view.php?id=CVE-2022-41848
drivers/char/pcmcia/synclink_cs.c in the Linux kernel through 5.19.12 has a race condition and resultant use-after-free if a physically proximate attacker removes a PCMCIA device while calling ioctl, aka a race condition between mgslpc_ioctl and mgslpc_detach. El archivo drivers/char/pcmcia/synclink_cs.c en el kernel de Linux versiones hasta 5.19.12, presenta una condición de carrera y un uso de memoria previamente liberada resultante si un atacante físicamente próximo elimina un dispositivo PCMCIA mientras llama a ioctl, también se conoce como una condición de carrera entre mgslpc_ioctl y mgslpc_detach • https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/log/drivers/char/pcmcia/synclink_cs.c https://lore.kernel.org/lkml/20220919040251.GA302541%40ubuntu/T/#rc85e751f467b3e6f9ccef92cfa7fb8a6cc50c270 • CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') CWE-416: Use After Free •
CVSS: 4.7EPSS: 0%CPEs: 2EXPL: 0CVE-2022-41850
https://notcve.org/view.php?id=CVE-2022-41850
roccat_report_event in drivers/hid/hid-roccat.c in the Linux kernel through 5.19.12 has a race condition and resultant use-after-free in certain situations where a report is received while copying a report->value is in progress. La función roccat_report_event en el archivo drivers/hid/hid-roccat.c en el kernel de Linux versiones hasta 5.19.12, presenta una condición de carrera y un uso de memoria previamente liberada resultante en determinadas situaciones en las que es recibido un informe mientras está siendo copiando un informe-)valor • https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=cacdb14b1c8d3804a3a7d31773bc7569837b71a4 https://lists.debian.org/debian-lts-announce/2022/12/msg00031.html https://lists.debian.org/debian-lts-announce/2022/12/msg00034.html https://lore.kernel.org/all/20220904193115.GA28134%40ubuntu/t/#u • CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') CWE-416: Use After Free •
CVSS: 4.2EPSS: 0%CPEs: 2EXPL: 0CVE-2022-41849
https://notcve.org/view.php?id=CVE-2022-41849
drivers/video/fbdev/smscufx.c in the Linux kernel through 5.19.12 has a race condition and resultant use-after-free if a physically proximate attacker removes a USB device while calling open(), aka a race condition between ufx_ops_open and ufx_usb_disconnect. El archivo drivers/video/fbdev/smscufx.c en el kernel de Linux versiones hasta 5.19.12, presenta una condición de carrera y un uso de memoria previamente liberada resultante si un atacante físicamente cercano elimina un dispositivo USB mientras llama a open(), también se conoce como una condición de carrera entre ufx_ops_open y ufx_usb_disconnect • https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=5610bcfe8693c02e2e4c8b31427f1bdbdecc839c https://lists.debian.org/debian-lts-announce/2022/12/msg00031.html https://lists.debian.org/debian-lts-announce/2022/12/msg00034.html https://lore.kernel.org/all/20220925133243.GA383897%40ubuntu/T • CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') CWE-416: Use After Free •