CVE-2022-50030
In the Linux kernel, the following vulnerability has been resolved: scsi: lpfc: Prevent buffer overflow crashes in debugfs with malformed user input Malformed user input to debugfs results in buffer overflow crashes.
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (0.20%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
In the Linux kernel, the following vulnerability has been resolved: scsi: lpfc: Prevent buffer overflow crashes in debugfs with malformed user input Malformed user input to debugfs results in buffer overflow crashes. Adapt input string lengths to fit within internal buffers, leaving space for NULL terminators.
- CVSS 3.1
- 7.8 HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- EPSS
- 0.20% probability · 11th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-787
- Affected
- linux/linux kernel
- Source
- 416baaa9-dc9f-4396-8d5f-8c081fb06d67
References
- https://git.kernel.org/stable/c/2d544e9d19c109dfe34b3dc1253a8b2971abe060Patch
- https://git.kernel.org/stable/c/927907f1cbb3408cadde637fccfc17bb6b10a87dPatch
- https://git.kernel.org/stable/c/b92506dc51f81741eb26609175ac206c20f06e0aPatch
- https://git.kernel.org/stable/c/c29a4baaad38a332c0ae480cf6d6c5bf75ac1828Patch
- https://git.kernel.org/stable/c/f8191d40aa612981ce897e66cda6a88db8df17bbPatch
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.