Your submission was sent successfully! Close

You have successfully unsubscribed! Close

CVE-2022-3534

Published: 17 October 2022

A vulnerability classified as critical has been found in Linux Kernel. Affected is the function btf_dump_name_dups of the file tools/lib/bpf/btf_dump.c of the component libbpf. The manipulation leads to use after free. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-211032.

Notes

AuthorNote
mdeslaur
introduced by:
https://github.com/libbpf/libbpf/commit/7ac1547f32f060d84b06c74edbb2c6896cc07949

Priority

Medium

Cvss 3 Severity Score

8.0

Score breakdown

Status

Package Release Status
libbpf
Launchpad, Ubuntu, Debian
bionic Does not exist

focal
Released (0.5.0-1~ubuntu20.04.1+esm1)
jammy
Released (0.5.0-1ubuntu22.04.1)
kinetic
Released (0.8.0-1ubuntu22.10.1)
trusty Ignored
(out of standard support)
upstream Needs triage

xenial Ignored
(out of standard support)
Patches:
upstream: https://github.com/libbpf/libbpf/commit/54caf920db0e489de90f3aaaa41e2a51ddbcd084

Severity score breakdown

Parameter Value
Base score 8.0
Attack vector Adjacent
Attack complexity Low
Privileges required Low
User interaction None
Scope Unchanged
Confidentiality High
Integrity impact High
Availability impact High
Vector CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H