CVE-2022-3435

Se ha encontrado una vulnerabilidad clasificada como problemática en el Kernel de Linux. Afecta a la función fib_nh_match del archivo net/ipv4/fib_semantics.c del componente IPv4 Handler. La manipulación conlleva a una lectura fuera de límites. Es posible iniciar el ataque de forma remota. Es recomendado aplicar un parche para corregir este problema. Ha sido asignado el identificador VDB-210357 a esta vulnerabilidad

An out-of-bounds memory read flaw was found in the Linux kernel. The IPv4 Handler component may delete IPv4 routes containing a multipath spec while the fib_info is using a nexthop object. This issue allows a local attacker access to unauthorized data.

It was discovered that the Upper Level Protocol subsystem in the Linux kernel did not properly handle sockets entering the LISTEN state in certain protocols, leading to a use-after-free vulnerability. A local attacker could use this to cause a denial of service or possibly execute arbitrary code. Davide Ornaghi discovered that the netfilter subsystem in the Linux kernel did not properly handle VLAN headers in some situations. A local attacker could use this to cause a denial of service or possibly execute arbitrary code.