CVE-2022-49919
In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: release flow rule object from commit path No need to postpone this to the commit release path, since no packets are walking over this object, this is accessed from…
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (0.15%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: release flow rule object from commit path No need to postpone this to the commit release path, since no packets are walking over this object, this is accessed from control plane only. This helped uncovered UAF triggered by races with the netlink notifier.
- CVSS 3.1
- 7.0 HIGHCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
- EPSS
- 0.15% probability · 5th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-362, CWE-416
- Affected
- linux/linux kernel
- Source
- 416baaa9-dc9f-4396-8d5f-8c081fb06d67
References
- https://git.kernel.org/stable/c/26b5934ff4194e13196bedcba373cd4915071d0ePatch
- https://git.kernel.org/stable/c/4ab6f96444e936f5e4a936d5c0bc948144bcded3Patch
- https://git.kernel.org/stable/c/6044791b7be707fd0e709f26e961a446424e5051Patch
- https://git.kernel.org/stable/c/74fd5839467054cd9c4d050614d3ee8788386171Patch
- https://git.kernel.org/stable/c/b2d7a92aff0fbd93c29d2aa6451fb99f050e2c4ePatch
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.