VulnerabilityModified
CVE-2022-21499
KGDB and KDB allow read and write access to kernel memory, and thus should be restricted during lockdown.
MEDIUM 6.7EPSS 0.62%
Does this matter?
Lower severity and a low EPSS score (0.62%). Track it; it rarely justifies an emergency change on its own.
Description
KGDB and KDB allow read and write access to kernel memory, and thus should be restricted during lockdown. An attacker with access to a serial port could trigger the debugger so it is important that the debugger respect the lockdown mode when/if it is triggered. CVSS 3.1 Base Score 6.7 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).
- CVSS 3.1
- 6.7 MEDIUMCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
- EPSS
- 0.62% probability · 48th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-787
- Affected
- oracle/linux · debian/debian linux
- Source
- secalert_us@oracle.com
References
- http://packetstormsecurity.com/files/168191/Kernel-Live-Patch-Security-Notice-LSN-0089-1.htmlThird Party Advisory, VDB Entry
- https://git.kernel.org/linus/eadb2f47a3ced5c64b23b90fd2a3463f63726066Mailing List, Patch, Vendor Advisory
- https://www.debian.org/security/2022/dsa-5161Third Party Advisory
- http://packetstormsecurity.com/files/168191/Kernel-Live-Patch-Security-Notice-LSN-0089-1.htmlThird Party Advisory, VDB Entry
- https://git.kernel.org/linus/eadb2f47a3ced5c64b23b90fd2a3463f63726066Mailing List, Patch, Vendor Advisory
- https://www.debian.org/security/2022/dsa-5161Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.