CVE-2022-0646CWE-459

A flaw use after free in the Linux kernel Management Component Transport Protocol (MCTP) subsystem was found in the way user triggers cancel_work_sync after…

published February 18, 2022

CVSS
—
EPSS
0%
Percentile
28.1
In the wild
Unconfirmed
What it is

A flaw use after free in the Linux kernel Management Component Transport Protocol (MCTP) subsystem was found in the way user triggers cancel_work_sync after the unregister_netdev during removing device. A local user could use this flaw to crash the system or escalate their privileges on the system. It is actual from Linux Kernel 5.17-rc1 (when mctp-serial.c introduced) till 5.17-rc5.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00356 · 28.1th percentile
Weakness
CWE-459 · Incomplete Cleanup
Published
2022-02-18T17:50Z
EPSS history
Timeline
  • 18 FEB 17:50Z
    A flaw use after free in the Linux kernel Management Component Transport Protocol (MCTP) subsystem was found in the way user triggers cancel_work_sync after…
    cvelistv5