CVE-2022-0264CWE-755

CVE-2022-0264

Medium · published February 5, 2022

CVSS v3.1
5.5
EPSS
0%
Percentile
16.1
In the wild
Unconfirmed
What it is

A vulnerability was found in the Linux kernel's eBPF verifier when handling internal data structures. Internal memory locations could be returned to userspace. A local attacker with the permissions to insert eBPF code to the kernel can use this to leak internal kernel memory details defeating some of the exploit mitigations in place for the kernel. This flaws affects kernel versions < v5.16-rc6

The record
Technical detail
CVSS v3.1
5.5 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00255 · 16.1th percentile
Weakness
CWE-755 · Improper Handling of Exceptional Conditions
Published
2022-02-05T04:15Z
Affected products (7)
ProductVersionsFixed in
linux/linux_kernel< 5.165.16
linux/linux_kernelall versions—
linux/linux_kernelall versions—
linux/linux_kernelall versions—
linux/linux_kernelall versions—
linux/linux_kernelall versions—
linux/linux_kernelall versions—
References (2)
https://bugzilla.redhat.com/show_bug.cgi?id=2041547 · [email protected]https://bugzilla.redhat.com/show_bug.cgi?id=2041547 · af854a3a-2127-422b-91ae-364da2661108
EPSS history
Timeline
  • 04 FEB 00:00Z
    A vulnerability was found in the Linux kernel's eBPF verifier when handling internal data structures
    cvelistv5