CVE-2022-3533

Publication date 17 October 2022

Last updated 24 July 2024


Ubuntu priority

Cvss 3 Severity Score

5.7 · Medium

Score breakdown

A vulnerability was found in Linux Kernel. It has been rated as problematic. This issue affects the function parse_usdt_arg of the file tools/lib/bpf/usdt.c of the component BPF. The manipulation of the argument reg_name leads to memory leak. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-211031.

Read the notes from the security team

Status

Package Ubuntu Release Status
libbpf 22.10 kinetic
Fixed 0.8.0-1ubuntu22.10.1
22.04 LTS jammy
Not affected
20.04 LTS focal
Not affected
18.04 LTS bionic Not in release
16.04 LTS xenial Ignored end of standard support
14.04 LTS trusty Ignored end of standard support

Notes


mdeslaur

introduced by: https://github.com/libbpf/libbpf/commit/557499a13ede6ea86883d070af06621fe990572f introduced in 0.8.0

Patch details

For informational purposes only. We recommend not to cherry-pick updates. How can I get the fixes?

Package Patch details
libbpf

Severity score breakdown

Parameter Value
Base score 5.7 · Medium
Attack vector Adjacent
Attack complexity Low
Privileges required Low
User interaction None
Scope Unchanged
Confidentiality None
Integrity impact None
Availability impact High
Vector CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

References

Related Ubuntu Security Notices (USN)

    • USN-5759-1
    • LibBPF vulnerabilities
    • 5 December 2022

Other references