CVE-2022-49182
In the Linux kernel, the following vulnerability has been resolved: net: hns3: add vlan list lock to protect vlan list When adding port base VLAN, vf VLAN need to remove from HW and modify the vlan state in vf VLAN list as false.
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (0.27%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
In the Linux kernel, the following vulnerability has been resolved: net: hns3: add vlan list lock to protect vlan list When adding port base VLAN, vf VLAN need to remove from HW and modify the vlan state in vf VLAN list as false. If the periodicity task is freeing the same node, it may cause "use after free" error. This patch adds a vlan list lock to protect the vlan list.
- CVSS 3.1
- 7.8 HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- EPSS
- 0.27% probability · 19th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-416
- Affected
- linux/linux kernel
- Source
- 416baaa9-dc9f-4396-8d5f-8c081fb06d67
References
- https://git.kernel.org/stable/c/09e383ca97e798f9954189b741af54b5c51e7a97Patch
- https://git.kernel.org/stable/c/1932a624ab88ff407d1a1d567fe581faa15dc725Patch
- https://git.kernel.org/stable/c/30f0ff7176efe8ac6c55f85bce26ed58bb608758Patch
- https://git.kernel.org/stable/c/f58af41deeab0f45c9c80adf5f2de489ebbac3ddPatch
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.