Log in Start free

Vulnerability · Published Oct 17, 2022 · Assigned by VulDB

CVE-2022-3534Linux Kernel libbpf btf_dump.c btf_dump_name_dups use after free

Medium 5.5

In plain English

A medium-severity use-after-free in Kernel from Linux. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.0% (higher than 62% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)5.5Medium
Exploit odds (30 days)1.0%top 38.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

A vulnerability has been found in Linux Kernel up to 5.10.162/5.15.85/6.0.15/6.1.1. The impacted element is the function btf_dump_name_dups of the file tools/lib/bpf/btf_dump.c of the component libbpf. The manipulation leads to use after free. Upgrading to version 5.10.163, 5.15.86, 6.0.16, 6.1.2 and 6.2 is sufficient to resolve this issue. The identifier of the patch is c61650b869e0b6fb0c0a28ed42d928eea969afc8/fbe08093fb2334549859829ef81d42570812597d/8c64a8e76eb85d422af5ec60ccbf26e3ead8c333/a733bf10198eb5bb927890940de8ab457491ed3b/93c660ca40b5d2f7c1b1626e955a8e9fa30e0749. You should upgrade the affected component.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12libbpf1.1.0-1DEBIAN-CVE-2022-3534
Debian:13libbpf1.1.0-1DEBIAN-CVE-2022-3534
Debian:14libbpf1.1.0-1DEBIAN-CVE-2022-3534
Ubuntu:22.04:LTSlibbpf0.5.0-1ubuntu22.04.1USN-5759-1
Ubuntu:22.04:LTSlibbpf0.5.0-1ubuntu22.04.1UBUNTU-CVE-2022-3534

Affected products (as reported)

VendorProductVersions
Linux Kernel 5.10.1625.15.05.15.15.15.25.15.35.15.45.15.55.15.6

Weakness: CWE-416, CWE-119 · Vector: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C

References