CVE-2022-48779

  1. Yack CVE
  2. Vulnerabilities (CVE)
  3. CVE-2022-48779

7.8 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

I

n the Linux kernel, the following vulnerability has been resolved: net: mscc: ocelot: fix use-after-free in ocelot_vlan_del() ocelot_vlan_member_del() will free the struct ocelot_bridge_vlan, so if this is the same as the port's pvid_vlan which we access afterwards, what we're accessing is freed memory. Fix the bug by determining whether to clear ocelot_port->pvid_vlan prior to calling ocelot_vlan_member_del().

References
Link Resource
https://git.kernel.org/stable/c/c98bed60cdd7f22237ae256cc9c1c3087206b8a2 Mailing List Patch
https://git.kernel.org/stable/c/ef57640575406f57f5b3393cf57f457b0ace837e Mailing List Patch
https://git.kernel.org/stable/c/c98bed60cdd7f22237ae256cc9c1c3087206b8a2 Mailing List Patch
https://git.kernel.org/stable/c/ef57640575406f57f5b3393cf57f457b0ace837e Mailing List Patch
Configurations

Configuration 1 (hide)

cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
History

21 Nov 2024, 07:34

Type Values Removed Values Added
References () https://git.kernel.org/stable/c/c98bed60cdd7f22237ae256cc9c1c3087206b8a2 - Mailing List, Patch () https://git.kernel.org/stable/c/c98bed60cdd7f22237ae256cc9c1c3087206b8a2 - Mailing List, Patch
References () https://git.kernel.org/stable/c/ef57640575406f57f5b3393cf57f457b0ace837e - Mailing List, Patch () https://git.kernel.org/stable/c/ef57640575406f57f5b3393cf57f457b0ace837e - Mailing List, Patch

21 Aug 2024, 18:00

Type Values Removed Values Added
First Time Linux linux Kernel
Linux
CWE CWE-416
Summary
  • (es) En el kernel de Linux se ha resuelto la siguiente vulnerabilidad: net: mscc: ocelot: fix use-after-free en ocelot_vlan_del() ocelot_vlan_member_del() liberará la estructura ocelot_bridge_vlan, por lo que si es la misma que la pvid_vlan del puerto al que accedemos después, a lo que accedemos es a la memoria liberada. Corrija el error determinando si se debe borrar ocelot_port->pvid_vlan antes de llamar a ocelot_vlan_member_del().
References () https://git.kernel.org/stable/c/c98bed60cdd7f22237ae256cc9c1c3087206b8a2 - () https://git.kernel.org/stable/c/c98bed60cdd7f22237ae256cc9c1c3087206b8a2 - Mailing List, Patch
References () https://git.kernel.org/stable/c/ef57640575406f57f5b3393cf57f457b0ace837e - () https://git.kernel.org/stable/c/ef57640575406f57f5b3393cf57f457b0ace837e - Mailing List, Patch
CPE cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 7.8

16 Jul 2024, 12:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-07-16 12:15

Updated : 2024-11-21 07:34

NVD link : CVE-2022-48779

Mitre link : CVE-2022-48779

CVE.ORG link : CVE-2022-48779

JSON object : View

Products Affected

linux

CWE
CWE-416

Use After Free