CVE-2022-2905CWE-125

CVE-2022-2905

Medium · published September 9, 2022

CVSS v3.1
5.5
EPSS
0%
Percentile
29.2
In the wild
Unconfirmed
What it is

An out-of-bounds memory read flaw was found in the Linux kernel's BPF subsystem in how a user calls the bpf_tail_call function with a key larger than the max_entries of the map. This flaw allows a local user to gain unauthorized access to data.

The record
Technical detail
CVSS v3.1
5.5 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00365 · 29.2th percentile
Weakness
CWE-125 · Out-of-bounds Read
Published
2022-09-09T19:15Z
Affected products (6)
ProductVersionsFixed in
linux/linux_kernel< 6.06.0
linux/linux_kernelall versions—
linux/linux_kernelall versions—
linux/linux_kernelall versions—
redhat/enterprise_linuxall versions—
debian/debian_linuxall versions—
References (8)
https://bugzilla.redhat.com/show_bug.cgi?id=2121800 · [email protected]https://lists.debian.org/debian-lts-announce/2022/11/msg00001.html · [email protected]https://lore.kernel.org/bpf/984b37f9fdf7ac36831d2137415a4a915744c1b6.1661462653.git.daniel%40iogearbox.net/ · [email protected]https://bugzilla.redhat.com/show_bug.cgi?id=2121800 · af854a3a-2127-422b-91ae-364da2661108https://lists.debian.org/debian-lts-announce/2022/11/msg00001.html · af854a3a-2127-422b-91ae-364da2661108https://lore.kernel.org/bpf/984b37f9fdf7ac36831d2137415a4a915744c1b6.1661462653.git.daniel%40iogearbox.net/ · af854a3a-2127-422b-91ae-364da2661108https://cert-portal.siemens.com/productcert/html/ssa-794697.html · 0b142b55-0307-4c5a-b3c9-f314f3fb7c5ehttps://cert-portal.siemens.com/productcert/html/ssa-831302.html · 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e
EPSS history
Timeline
  • 09 SEP 00:00Z
    An out-of-bounds memory read flaw was found in the Linux kernel's BPF subsystem in how a user calls the bpf_tail_call function with a key larger than the…
    cvelistv5