CVE-2022-1786

kernel: invalid-free in io_uring that can lead to LPE

A use-after-free flaw was found in the Linux kernel’s io_uring subsystem in the way a user sets up a ring with IORING_SETUP_IOPOLL with more than one task completing submissions on this ring. This flaw allows a local user to crash or escalate their privileges on the system.

CVSS 3.1 · 7.8 High EPSS 1.0% KEV · Not listed

Vendors

Linux Netapp

Products

Linux Kernel H300s H300s Firmware and 8 more

CVE-2022-1734

kernel: Use-After-Free in NFC driver in nfcmrvl_nci_unregister_dev when simulating NFC device from user-space

A flaw in Linux Kernel found in nfcmrvl_nci_unregister_dev() in drivers/nfc/nfcmrvl/main.c can lead to use after free both read or write when non synchronized between cleanup routine and firmware download routine.

CVSS 3.1 · 7.0 High EPSS < 1% KEV · Not listed

Vendors

Debian Linux Netapp

Products

Debian Linux Linux Kernel H300e and 15 more

CVE-2022-1678

kernel: improper update of sock reference in TCP pacing can lead to memory leak

An issue was discovered in the Linux Kernel from 4.18 to 4.19, an improper update of sock reference in TCP pacing can lead to memory/netns leak, which can be used by remote clients.

CVSS 3.1 · 5.9 Medium EPSS 2.9% KEV · Not listed

Vendors

Linux Netapp

Products

Linux Kernel Active Iq Unified Manager Bootstrap Os and 23 more

CVE-2022-1671

kernel: null-ptr-deref bugs in net/rxrpc/server_key.c in rxrpc_preparse_s

A NULL pointer dereference flaw was found in rxrpc_preparse_s in net/rxrpc/server_key.c in the Linux kernel. This flaw allows a local attacker to crash the system or leak internal kernel information.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Linux Netapp

Products

Linux Kernel H300s H300s Firmware and 8 more

CVE-2022-1652

kernel: A concurrency use-after-free in floppy disk device driver.

Linux Kernel could allow a local attacker to execute arbitrary code on the system, caused by a concurrency use-after-free flaw in the bad_flp_intr function. By executing a specially-crafted program, an attacker could exploit this vulnerability to execute arbitrary code or cause a denial of service condition on the system.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Debian Linux Netapp and 1 more

Products

Debian Linux Linux Kernel H300s and 10 more

CVE-2022-1587

pcre2: Out-of-bounds read in get_recurse_data_length in pcre2_jit_compile.c

An out-of-bounds read vulnerability was discovered in the PCRE2 library in the get_recurse_data_length() function of the pcre2_jit_compile.c file. This issue affects recursions in JIT-compiled regular expressions caused by duplicate data transfers.

CVSS 3.1 · 9.1 Critical EPSS 2.8% KEV · Not listed

Vendors

Fedoraproject Netapp Pcre and 1 more

Products

Fedora Active Iq Unified Manager H300s and 14 more

CVE-2022-1353

kernel: kernel info leak issue in pfkey_register

A vulnerability was found in the pfkey_register function in net/key/af_key.c in the Linux kernel. This flaw allows a local, unprivileged user to gain access to kernel memory, leading to a system crash or a leak of internal kernel information.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Debian Linux Netapp and 1 more

Products

Debian Linux Linux Kernel H300e and 18 more

CVE-2022-1183

Destroying a TLS session early causes assertion failure

On vulnerable configurations, the named daemon may, in some circumstances, terminate with an assertion failure. Vulnerable configurations are those that include a reference to http within the listen-on statements in their named.conf. TLS is used by both DNS over TLS (DoT) and DNS over HTTPS (DoH), but configurations using DoT alone are unaffected. Affects BIND 9.18.0 -> 9.18.2 and version 9.19.0 of the BIND 9.19 development branch.

CVSS 3.1 · 7.5 High EPSS 6.2% KEV · Not listed

Vendors

Isc Netapp

Products

Bind H300s H300s Firmware and 8 more

CVE-2022-1048

kernel: race condition in snd_pcm_hw_free leading to use-after-free

A use-after-free flaw was found in the Linux kernel’s sound subsystem in the way a user triggers concurrent calls of PCM hw_params. The hw_free ioctls or similar race condition happens inside ALSA PCM for other ioctls. This flaw allows a local user to crash or potentially escalate their privileges on the system.

CVSS 3.1 · 7.0 High EPSS < 1% KEV · Not listed

Vendors

Debian Linux Netapp and 1 more

Products

Debian Linux Linux Kernel H300e and 19 more

CVE-2022-0998

kernel: an integer overflow in the vhost_vdpa_config_validate() can lead to out-of-bounds access on top of a 32-bit Linux kernel

An integer overflow flaw was found in the Linux kernel’s virtio device driver code in the way a user triggers the vhost_vdpa_config_validate function. This flaw allows a local user to crash or potentially escalate their privileges on the system.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Linux Netapp

Products

Linux Kernel H300e H300e Firmware and 14 more

CVE-2022-0667

Assertion failure on delayed DS lookup

When the vulnerability is triggered the BIND process will exit. BIND 9.18.0

CVSS 3.1 · 7.5 High EPSS 1.4% KEV · Not listed

Vendors

Isc Netapp

Products

Bind H300e H300e Firmware and 14 more

CVE-2022-0646

kernel: uaf bug in mctp-serial.c

A flaw use after free in the Linux kernel Management Component Transport Protocol (MCTP) subsystem was found in the way user triggers cancel_work_sync after the unregister_netdev during removing device. A local user could use this flaw to crash the system or escalate their privileges on the system. It is actual from Linux Kernel 5.17-rc1 (when mctp-serial.c introduced) till 5.17-rc5.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Linux Netapp

Products

Linux Kernel H300e H300e Firmware and 14 more

CVE-2022-0635

bind: Lookups involving a DNAME could trigger an assertion failure when 'synth-from-dnssec' was enabled (which is the default)

Versions affected: BIND 9.18.0 When a vulnerable version of named receives a series of specific queries, the named process will eventually terminate due to a failed assertion check.

CVSS 3.1 · 7.5 High EPSS 1.4% KEV · Not listed

Vendors

Isc Netapp

Products

Bind H300e H300e Firmware and 14 more

CVE-2022-0516

kernel: missing check in ioctl allows kernel memory read/write

A vulnerability was found in kvm_s390_guest_sida_op in the arch/s390/kvm/kvm-s390.c function in KVM for s390 in the Linux kernel. This flaw allows a local attacker with a normal user privilege to obtain unauthorized memory write access. This flaw affects Linux kernel versions prior to 5.17-rc4.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Debian Fedoraproject Linux and 2 more

Products

Debian Linux Fedora Linux Kernel and 29 more

CVE-2022-0396

DoS from specifically crafted TCP packets

BIND 9.16.11 -> 9.16.26, 9.17.0 -> 9.18.0 and versions 9.16.11-S1 -> 9.16.26-S1 of the BIND Supported Preview Edition. Specifically crafted TCP streams can cause connections to BIND to remain in CLOSE_WAIT status for an indefinite period of time, even after the client has terminated the connection.

CVSS 3.1 · 5.3 Medium EPSS 2.7% KEV · Not listed

Vendors

Fedoraproject Isc Netapp and 2 more

Products

Fedora Bind H300e and 17 more

CVE-2022-0330

kernel: possible privileges escalation due to missing TLB flush

A random memory access flaw was found in the Linux kernel's GPU i915 kernel driver functionality in the way a user may run malicious code on the GPU. This flaw allows a local user to crash the system or escalate their privileges on the system.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Fedoraproject Linux Netapp and 1 more

Products

Fedora Linux Kernel H300e and 49 more

CVE-2021-4203

kernel: Race condition in races in sk_peer_pid and sk_peer_cred accesses

A use-after-free read flaw was found in sock_getsockopt() in net/core/sock.c due to SO_PEERCRED and SO_PEERGROUPS race with listen() (and connect()) in the Linux kernel. In this flaw, an attacker with a user privileges may crash the system or leak internal kernel information.

CVSS 3.1 · 6.8 Medium EPSS 1.7% KEV · Not listed

Vendors

Linux Netapp Oracle and 1 more

Products

Linux Kernel A700s A700s Firmware and 22 more

CVE-2021-4197

kernel: cgroup: Use open-time creds and namespace for migration perm checks

An unprivileged write to the file handler flaw in the Linux kernel's control groups and namespaces subsystem was found in the way users have access to some less privileged process that are controlled by cgroups and have higher privileged parent process. It is actually both for cgroup2 and cgroup1 versions of control groups. A local user could use this flaw to crash the system or escalate their privileges on the system.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Broadcom Debian Linux and 3 more

Products

Brocade Fabric Operating System Firmware Debian Linux Linux Kernel and 13 more

CVE-2021-4083

kernel: fget: check that the fd still exists after getting a ref to it

A read-after-free memory flaw was found in the Linux kernel's garbage collection for Unix domain socket file handlers in the way users call close() and fget() simultaneously and can potentially trigger a race condition. This flaw allows a local user to crash the system or escalate their privileges on the system. This flaw affects Linux kernel versions prior to 5.16-rc4.

CVSS 3.1 · 7.0 High EPSS < 1% KEV · Not listed

Vendors

Debian Linux Netapp and 2 more

Products

Debian Linux Linux Kernel H300e and 27 more

CVE-2021-4044

Invalid handling of X509_verify_cert() internal errors in libssl

Internally libssl in OpenSSL calls X509_verify_cert() on the client side to verify a certificate supplied by a server. That function may return a negative return value to indicate an internal error (for example out of memory). Such a negative return value is mishandled by OpenSSL and will cause an IO function (such as SSL_connect() or SSL_do_handshake()) to not indicate success and a subsequent call to SSL_get_error() to return the value SSL_ERROR_WANT_RETRY_VERIFY. This return value is only supposed to be returned by OpenSSL if the application has previously called SSL_CTX_set_cert_verify_callback(). Since most applications do not do this the SSL_ERROR_WANT_RETRY_VERIFY return value from SSL_get_error() will be totally unexpected and applications may not behave correctly as a result. The exact behaviour will depend on the application but it could result in crashes, infinite loops or other similar incorrect responses. This issue is made more serious in combination with a separate bug in OpenSSL 3.0 that will cause X509_verify_cert() to indicate an internal error when processing a certificate chain. This will occur where a certificate does not include the Subject Alternative Name extension but where a Certificate Authority has enforced name constraints. This issue can occur even with valid chains. By combining the two issues an attacker could induce incorrect, application dependent behaviour. Fixed in OpenSSL 3.0.1 (Affected 3.0.0).

CVSS 3.1 · 7.5 High EPSS 50.1% KEV · Not listed

Vendors

Netapp Nodejs Openssl

Products

500f 500f Firmware A250 and 23 more