Vulnerability · Published May 25, 2022 · Assigned by Anolis
CVE-2022-1678
Medium 5.9
In plain English
A medium-severity security flaw in kernel. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.9% (higher than 87% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)5.9Medium
Exploit odds (30 days)2.9%top 12.8% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
An issue was discovered in the Linux Kernel from 4.18 to 4.19, an improper update of sock reference in TCP pacing can lead to memory/netns leak, which can be used by remote clients.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | linux | 5.2.6-1 | DEBIAN-CVE-2022-1678 |
| Debian:13 | linux | 5.2.6-1 | DEBIAN-CVE-2022-1678 |
| Debian:14 | linux | 5.2.6-1 | DEBIAN-CVE-2022-1678 |
Affected products (as reported)
Weakness: CWE-911 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
References
- https://bugzilla.openanolis.cn/show_bug.cgi?id=61 x_refsource_CONFIRM
- https://lore.kernel.org/all/20200602080425.93712-1-kerneljasonxing%40gmail.com/ x_refsource_MISC
- https://github.com/torvalds/linux/commit/0a70f118475e037732557796accd0878a00fc25a x_refsource_MISC
- https://gitee.com/anolis/cloud-kernel/commit/bed537da691b x_refsource_MISC
- https://anas.openanolis.cn/cves/detail/CVE-2022-1678 x_refsource_MISC
- https://anas.openanolis.cn/errata/detail/ANSA-2022:0143 x_refsource_MISC
- https://security.netapp.com/advisory/ntap-20220715-0001/ x_refsource_CONFIRM