CVE-2022-48502

Severity Score

7.1

*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

An issue was discovered in the Linux kernel before 6.2. The ntfs3 subsystem does not properly check for correctness during disk reads, leading to an out-of-bounds read in ntfs_set_ea in fs/ntfs3/xattr.c.

Se ha descubierto un problema en el kernel de Linux en las versiones anteriores a v6.2. El subsistema "ntfs3" no comprueba correctamente la corrección durante las lecturas de disco, lo que provoca una lectura fuera de los límites en "ntfs_set_ea" en "fs/ntfs3/xattr.c".

*Credits: N/A

CVSS Scores

NISTv3.1 7.1

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

High

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2023-05-31 CVE Reserved
2023-05-31 CVE Published
2024-06-06 EPSS Updated
2024-08-03 CVE Updated
2024-08-03 First Exploit
---------- Exploited in Wild
---------- KEV Due Date

CWE

CWE-125: Out-of-bounds Read

CAPEC

References (4)

URL	Tag	Source
https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.2	Release Notes
https://security.netapp.com/advisory/ntap-20230703-0004	Third Party Advisory

URL	Date	SRC
https://syzkaller.appspot.com/bug?extid=8778f030156c6cd16d72	2024-08-03

URL	Date	SRC
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=0e8235d28f3a0e9eda9f02ff67ee566d5f42b66b	2023-12-15

URL	Date	SRC

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Linux Search vendor "Linux"		Linux Kernel Search vendor "Linux" for product "Linux Kernel"				>= 5.15 < 5.15.121 Search vendor "Linux" for product "Linux Kernel" and version " >= 5.15 < 5.15.121"		-		Affected
Linux Search vendor "Linux"		Linux Kernel Search vendor "Linux" for product "Linux Kernel"				>= 5.16 < 6.1.40 Search vendor "Linux" for product "Linux Kernel" and version " >= 5.16 < 6.1.40"		-		Affected
Netapp Search vendor "Netapp"		H300s Search vendor "Netapp" for product "H300s"				-		-		Affected
Netapp Search vendor "Netapp"		H410c Search vendor "Netapp" for product "H410c"				-		-		Affected
Netapp Search vendor "Netapp"		H410s Search vendor "Netapp" for product "H410s"				-		-		Affected
Netapp Search vendor "Netapp"		H500s Search vendor "Netapp" for product "H500s"				-		-		Affected
Netapp Search vendor "Netapp"		H700s Search vendor "Netapp" for product "H700s"				-		-		Affected