Your submission was sent successfully! Close

You have successfully unsubscribed! Close

Thank you for signing up for our newsletter!
In these regular emails you will find the latest updates about Ubuntu and upcoming events where you can meet our team.Close

CVE-2022-3534

Published: 17 October 2022

A vulnerability classified as critical has been found in Linux Kernel. Affected is the function btf_dump_name_dups of the file tools/lib/bpf/btf_dump.c of the component libbpf. The manipulation leads to use after free. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-211032.

Notes

AuthorNote
mdeslaur
introduced by:
https://github.com/libbpf/libbpf/commit/7ac1547f32f060d84b06c74edbb2c6896cc07949

Priority

Medium

Cvss 3 Severity Score

8.0

Score breakdown

Status

Package Release Status
dwarves-dfsg
Launchpad, Ubuntu, Debian
trusty Ignored
(end of standard support)
xenial Needs triage

bionic
Released (1.21-0ubuntu1~18.04.1+esm1)
Available with Ubuntu Pro
focal
Released (1.21-0ubuntu1~20.04.1)
jammy Does not exist

kinetic Does not exist

lunar Does not exist

upstream Needs triage

mantic Does not exist

libbpf
Launchpad, Ubuntu, Debian
bionic Does not exist

lunar
Released (1.0.1-2ubuntu1)
trusty Ignored
(end of standard support)
upstream Needs triage

xenial Ignored
(end of standard support)
jammy
Released (0.5.0-1ubuntu22.04.1)
kinetic
Released (0.8.0-1ubuntu22.10.1)
focal
Released (0.5.0-1~ubuntu20.04.1+esm1)
Available with Ubuntu Pro
mantic
Released (1.0.1-2ubuntu1)
Patches:
upstream: https://github.com/libbpf/libbpf/commit/54caf920db0e489de90f3aaaa41e2a51ddbcd084

Severity score breakdown

Parameter Value
Base score 8.0
Attack vector Adjacent
Attack complexity Low
Privileges required Low
User interaction None
Scope Unchanged
Confidentiality High
Integrity impact High
Availability impact High
Vector CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H