Vulnerability · Published Feb 18, 2022 · Assigned by redhat
CVE-2022-0646
High 7.8
In plain English
A high-severity security flaw in Kernel. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 29% of all known vulnerabilities).
Severity (CVSS NVD)7.8High
Exploit odds (30 days)0.4%top 70.5% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
A flaw use after free in the Linux kernel Management Component Transport Protocol (MCTP) subsystem was found in the way user triggers cancel_work_sync after the unregister_netdev during removing device. A local user could use this flaw to crash the system or escalate their privileges on the system. It is actual from Linux Kernel 5.17-rc1 (when mctp-serial.c introduced) till 5.17-rc5.
Affected products (as reported)
Weakness: CWE-459
References
- https://lore.kernel.org/all/20220211011552.1861886-1-jk%40codeconstruct.com.au x_refsource_MISC
- https://security.netapp.com/advisory/ntap-20220318-0006/ x_refsource_CONFIRM