Log in Start free

Vulnerability · Published Oct 21, 2022 · Assigned by VulDB

CVE-2022-3636Linux Kernel Ethernet mtk_ppe.c __mtk_ppe_check_skb use after free

Medium 5.5

In plain English

A medium-severity use-after-free in Kernel from Linux. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 30% of all known vulnerabilities).

Severity (CVSS 3.1)5.5Medium
Exploit odds (30 days)0.4%top 69.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

A vulnerability was identified in Linux Kernel 33fc42de33278b2b3ec6f3390512987bc29a62b7. This affects the function __mtk_ppe_check_skb of the file drivers/net/ethernet/mediatek/mtk_ppe.c of the component Ethernet Handler. Such manipulation leads to use after free. The name of the patch is 17a5f6a78dc7b8db385de346092d7d9f9dc24df6. It is best practice to apply a patch to resolve this issue. No released Linux Kernel version was ever affected by this CVE.

Affected products (as reported)

VendorProductVersions
Linux Kernel 33fc42de33278b2b3ec6f3390512987bc29a62b7

Weakness: CWE-416, CWE-119 · Vector: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C

References