CVE-2022-32250CWE-416

CVE-2022-32250

High · published June 3, 2022

CVSS v3.1
7.8
EPSS
3%
Percentile
86.9
In the wild
Unconfirmed
What it is

net/netfilter/nf_tables_api.c in the Linux kernel through 5.18.1 allows a local user (able to create user/net namespaces) to escalate privileges to root because an incorrect NFT_STATEFUL_EXPR check leads to a use-after-free.

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.02914 · 86.9th percentile
Weakness
CWE-416 · Use After Free
Published
2022-06-03T01:15Z
Affected products (17)
ProductVersionsFixed in
linux/linux_kernel≥ 4.1, < 4.9.3184.9.318
linux/linux_kernel≥ 4.10, < 4.14.2834.14.283
linux/linux_kernel≥ 4.15, < 4.19.2474.19.247
linux/linux_kernel≥ 4.20, < 5.4.1985.4.198
linux/linux_kernel≥ 5.5, < 5.10.1205.10.120
linux/linux_kernel≥ 5.11, < 5.15.455.15.45
linux/linux_kernel≥ 5.16, < 5.17.135.17.13
linux/linux_kernel≥ 5.18, < 5.18.25.18.2
fedoraproject/fedoraall versions—
fedoraproject/fedoraall versions—
debian/debian_linuxall versions—
debian/debian_linuxall versions—
netapp/h300s_firmwareall versions—
netapp/h500s_firmwareall versions—
netapp/h700s_firmwareall versions—
netapp/h410s_firmwareall versions—
netapp/h410c_firmwareall versions—
References (37)
https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git/commit/net/netfilter?id=520778042ccca019f3ffa136dd0ca565c486cedd · af854a3a-2127-422b-91ae-364da2661108https://github.com/theori-io/CVE-2022-32250-exploit · af854a3a-2127-422b-91ae-364da2661108https://lists.debian.org/debian-lts-announce/2022/07/msg00000.html · af854a3a-2127-422b-91ae-364da2661108https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MO6Y3TC4WUUNKRP7OQA26OVTZTPCS6F2/ · af854a3a-2127-422b-91ae-364da2661108https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UIZTJOJCVVEJVOQSCHE6IJQKMPISHQ5L/ · af854a3a-2127-422b-91ae-364da2661108https://security.netapp.com/advisory/ntap-20220715-0005/ · af854a3a-2127-422b-91ae-364da2661108https://www.debian.org/security/2022/dsa-5161 · af854a3a-2127-422b-91ae-364da2661108https://www.debian.org/security/2022/dsa-5173 · af854a3a-2127-422b-91ae-364da2661108https://www.openwall.com/lists/oss-security/2022/05/31/1 · af854a3a-2127-422b-91ae-364da2661108https://cert-portal.siemens.com/productcert/html/ssa-794697.html · 0b142b55-0307-4c5a-b3c9-f314f3fb7c5ehttp://www.openwall.com/lists/oss-security/2022/06/03/1 · [email protected]http://www.openwall.com/lists/oss-security/2022/06/04/1 · [email protected]http://www.openwall.com/lists/oss-security/2022/06/20/1 · [email protected]http://www.openwall.com/lists/oss-security/2022/07/03/5 · [email protected]http://www.openwall.com/lists/oss-security/2022/07/03/6 · [email protected]http://www.openwall.com/lists/oss-security/2022/08/25/1 · [email protected]http://www.openwall.com/lists/oss-security/2022/09/02/9 · [email protected]https://blog.theori.io/research/CVE-2022-32250-linux-kernel-lpe-2022/ · [email protected]https://bugzilla.redhat.com/show_bug.cgi?id=2092427 · [email protected]https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git/commit/net/netfilter?id=520778042ccca019f3ffa136dd0ca565c486cedd · [email protected]https://github.com/theori-io/CVE-2022-32250-exploit · [email protected]https://lists.debian.org/debian-lts-announce/2022/07/msg00000.html · [email protected]https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MO6Y3TC4WUUNKRP7OQA26OVTZTPCS6F2/ · [email protected]https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UIZTJOJCVVEJVOQSCHE6IJQKMPISHQ5L/ · [email protected]https://security.netapp.com/advisory/ntap-20220715-0005/ · [email protected]https://www.debian.org/security/2022/dsa-5161 · [email protected]https://www.debian.org/security/2022/dsa-5173 · [email protected]https://www.openwall.com/lists/oss-security/2022/05/31/1 · [email protected]http://www.openwall.com/lists/oss-security/2022/06/03/1 · af854a3a-2127-422b-91ae-364da2661108http://www.openwall.com/lists/oss-security/2022/06/04/1 · af854a3a-2127-422b-91ae-364da2661108http://www.openwall.com/lists/oss-security/2022/06/20/1 · af854a3a-2127-422b-91ae-364da2661108http://www.openwall.com/lists/oss-security/2022/07/03/5 · af854a3a-2127-422b-91ae-364da2661108http://www.openwall.com/lists/oss-security/2022/07/03/6 · af854a3a-2127-422b-91ae-364da2661108http://www.openwall.com/lists/oss-security/2022/08/25/1 · af854a3a-2127-422b-91ae-364da2661108http://www.openwall.com/lists/oss-security/2022/09/02/9 · af854a3a-2127-422b-91ae-364da2661108https://blog.theori.io/research/CVE-2022-32250-linux-kernel-lpe-2022/ · af854a3a-2127-422b-91ae-364da2661108https://bugzilla.redhat.com/show_bug.cgi?id=2092427 · af854a3a-2127-422b-91ae-364da2661108
EPSS history
Timeline
  • 02 JUN 20:51Z
    net/netfilter/nf_tables_api.c in the Linux kernel through 5.18.1 allows a local user (able to create user/net namespaces) to escalate privileges to root…
    cvelistv5