CVSS: 5.5EPSS: 0%CPEs: 3EXPL: 0CVE-2022-1852 – kernel: NULL pointer dereference in x86_emulate_insn may lead to DoS
https://notcve.org/view.php?id=CVE-2022-1852
A NULL pointer dereference flaw was found in the Linux kernel’s KVM module, which can lead to a denial of service in the x86_emulate_insn in arch/x86/kvm/emulate.c. This flaw occurs while executing an illegal instruction in guest in the Intel CPU. Se ha encontrado un fallo de desreferencia de puntero NULL en el módulo KVM del kernel de Linux, que puede conllevar a una denegación de servicio en el archivo x86_emulate_insn en arch/x86/kvm/emulate.c. Este fallo es producido mientras es ejecutada una instrucción ilegal en el huésped en la CPU Intel • https://bugzilla.redhat.com/show_bug.cgi?id=2089815 https://github.com/torvalds/linux/commit/fee060cd52d69c114b62d1a2948ea9648b5131f9 https://access.redhat.com/security/cve/CVE-2022-1852 • CWE-476: NULL Pointer Dereference •
CVSS: 4.1EPSS: 0%CPEs: 1EXPL: 0CVE-2022-1974
https://notcve.org/view.php?id=CVE-2022-1974
A use-after-free flaw was found in the Linux kernel's NFC core functionality due to a race condition between kobject creation and delete. This vulnerability allows a local attacker with CAP_NET_ADMIN privilege to leak kernel information. Se ha encontrado un fallo de uso de memoria previamente liberada en la funcionalidad del núcleo NFC del kernel de Linux debido a una condición de carrera entre la creación y el borrado de kobject. Esta vulnerabilidad permite a un atacante local con privilegios CAP_NET_ADMIN filtrar información del kernel • https://github.com/torvalds/linux/commit/da5c0f119203ad9728920456a0f52a6d850c01cd • CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition CWE-416: Use After Free •
CVSS: 5.5EPSS: 0%CPEs: 1EXPL: 0CVE-2022-34494
https://notcve.org/view.php?id=CVE-2022-34494
rpmsg_virtio_add_ctrl_dev in drivers/rpmsg/virtio_rpmsg_bus.c in the Linux kernel before 5.18.4 has a double free. La función rpmsg_virtio_add_ctrl_dev en el archivo drivers/rpmsg/virtio_rpmsg_bus.c en el kernel de Linux versiones anteriores a 5.18.4, presenta una doble liberación • https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.18.4 https://github.com/torvalds/linux/commit/1680939e9ecf7764fba8689cfb3429c2fe2bb23c • CWE-415: Double Free •
CVSS: 5.5EPSS: 0%CPEs: 1EXPL: 0CVE-2022-34495
https://notcve.org/view.php?id=CVE-2022-34495
rpmsg_probe in drivers/rpmsg/virtio_rpmsg_bus.c in the Linux kernel before 5.18.4 has a double free. La función rpmsg_probe en el archivo drivers/rpmsg/virtio_rpmsg_bus.c en el kernel de Linux versiones anteriores a 5.18.4, presenta una doble liberación • https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.18.4 https://github.com/torvalds/linux/commit/c2eecefec5df1306eafce28ccdf1ca159a552ecc • CWE-415: Double Free •
CVSS: 7.4EPSS: 0%CPEs: 14EXPL: 0CVE-2022-1729 – kernel: race condition in perf_event_open leads to privilege escalation
https://notcve.org/view.php?id=CVE-2022-1729
A race condition was found the Linux kernel in perf_event_open() which can be exploited by an unprivileged user to gain root privileges. The bug allows to build several exploit primitives such as kernel address information leak, arbitrary execution, etc. Se ha encontrado una condición de carrera en el kernel de Linux en la función perf_event_open() que puede ser explotada por un usuario no privilegiado para conseguir privilegios de root. El bug permite construir varias primitivas de explotación como un filtrado de información de direcciones del kernel, una ejecución arbitraria, etc A use-after-free flaw was found in the Linux kernel’s performance events functionality. A user triggers a race condition in setting up performance monitoring between the leading PERF_TYPE_TRACEPOINT and sub PERF_EVENT_HARDWARE plus the PERF_EVENT_SOFTWARE using the perf_event_open() function with these three types. • https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=3ac6487e584a1eb54071dbe1212e05b884136704 https://security.netapp.com/advisory/ntap-20230214-0006 https://www.openwall.com/lists/oss-security/2022/05/20/2 https://access.redhat.com/security/cve/CVE-2022-1729 https://bugzilla.redhat.com/show_bug.cgi?id=2086753 • CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') CWE-366: Race Condition within a Thread •