CVE-2022-1011

kernel: FUSE allows UAF reads of write() buffers, allowing theft of (partial) /etc/shadow hashes

Published Mar 18, 2022 CVSS 3.1 · 7.8 High EPSS 1.2% KEV · Not listed
Description
A use-after-free flaw was found in the Linux kernel’s FUSE filesystem in the way a user triggers write(). This flaw allows a local user to gain unauthorized access to data from the FUSE filesystem, resulting in privilege escalation.

Remediation

No solution or workaround provided in the CVE record

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
Debian DLA Debian DLA DLA-3065-1 linux security update
Debian DSA Debian DSA DSA-5173-1 linux security update
EUVD EUVD EUVD-2022-24361 A use-after-free flaw was found in the Linux kernel’s FUSE filesystem in the way a user triggers write(). This flaw allows a local user to gain unauthorized access to data from the FUSE filesystem, resulting in privilege escalation.
Ubuntu USN Ubuntu USN USN-5381-1 Linux kernel (OEM) vulnerabilities
Ubuntu USN Ubuntu USN USN-5467-1 Linux kernel vulnerabilities
Ubuntu USN Ubuntu USN USN-5515-1 Linux kernel vulnerabilities
Ubuntu USN Ubuntu USN USN-5541-1 Linux kernel (Azure) vulnerabilities
History
Type Values Removed Values Added
CPEs cpe:2.3:o:linux:linux_kernel:5.17:rc5:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.17:rc6:*:*:*:*:*:*
Type Values Removed Values Added
First Time appeared Redhat rhel Els
CPEs cpe:/o:redhat:rhel_els:7
Vendors & Products Redhat rhel Els
Weaknesses

Sources

Status
PUBLISHED
Assigner
redhat
Published
Updated
Aug 2, 2024, 11:47 PM
Reserved
Mar 17, 2022, 12:00 AM
Status
Analyzed
Published
Mar 18, 2022, 6:15 PM
Modified
Aug 26, 2026, 6:13 PM
Severity
Moderate
Public date
Mar 7, 2022, 10:00 AM