CVE-2022-2978

Summary

CVE	CVE-2022-2978
State	PUBLIC
Assigner	[email protected]
Source Priority	CVE Program / NVD first with legacy fallback
Published	2022-08-24 16:15:00 UTC
Updated	2023-11-07 03:47:00 UTC
Description	A flaw use after free in the Linux kernel NILFS file system was found in the way user triggers function security_inode_alloc to fail with following call to function nilfs_mdt_destroy. A local user could use this flaw to crash the system or potentially escalate their privileges on the system.

Risk And Classification

Problem Types: CWE-416

NVD Known Affected Configurations (CPE 2.3)

Type	Vendor	Product	Version	Update	Edition	Language
Operating System	Debian	Debian Linux	10.0	All	All	All
Operating System	Linux	Linux Kernel	All	All	All	All
Operating System	Linux	Linux Kernel	6.0	rc3	All	All

References

Reference	Source	Link	Tags
[SECURITY] [DLA 3245-1] linux security update	MLIST	lists.debian.org
[PATCH v2] fs: fix UAF/GPF bug in nilfs_mdt_destroy	MISC	lore.kernel.org
[PATCH v2] fs: fix UAF/GPF bug in nilfs_mdt_destroy		lore.kernel.org
CVE Program record	CVE.ORG	www.cve.org	canonical
NVD vulnerability detail	NVD	nvd.nist.gov	canonical, analysis

No vendor comments have been submitted for this CVE.

Legacy QID Mappings

181221 Debian Security Update for linux (CVE-2022-2978)
181565 Debian Security Update for linux (DLA 3245-1)
198999 Ubuntu Security Notification for Linux kernel (OEM) Vulnerabilities (USN-5693-1)
199029 Ubuntu Security Notification for Linux kernel Vulnerabilities (USN-5728-1)
199030 Ubuntu Security Notification for Linux kernel Vulnerabilities (USN-5727-1)
199031 Ubuntu Security Notification for Linux kernel Vulnerabilities (USN-5729-1)
199036 Ubuntu Security Notification for Linux kernel (GCP) Vulnerabilities (USN-5727-2)
199037 Ubuntu Security Notification for Linux kernel Vulnerabilities (USN-5728-2)
199038 Ubuntu Security Notification for Linux kernel Vulnerabilities (USN-5729-2)
199051 Ubuntu Security Notification for Linux kernel (GCP) Vulnerabilities (USN-5728-3)
199072 Ubuntu Security Notification for Linux kernel (Azure) Vulnerabilities (USN-5774-1)
354251 Amazon Linux Security Advisory for kernel : ALAS-2022-1645
377035 Alibaba Cloud Linux Security Update for cloud-kernel (ALINUX2-SA-2022:0038)
377117 Alibaba Cloud Linux Security Update for cloud-kernel (ALINUX3-SA-2022:0158)
377871 Alibaba Cloud Linux Security Update for cloud-kernel (ALINUX2-SA-2023:0001)
377891 Alibaba Cloud Linux Security Update for cloud-kernel (ALINUX3-SA-2023:0002)
6140323 AWS Bottlerocket Security Update for kernel (GHSA-2r75-pvxx-p558)
752839 SUSE Enterprise Linux Security Update for the Linux Kernel (SUSE-SU-2022:3929-1)
752880 SUSE Enterprise Linux Security Update for the Linux Kernel (SUSE-SU-2022:4053-1)
752889 SUSE Enterprise Linux Security Update for the Linux Kernel (SUSE-SU-2022:3897-1)
752911 SUSE Enterprise Linux Security Update for the Linux Kernel (SUSE-SU-2022:3998-1)
752913 SUSE Enterprise Linux Security Update for the Linux Kernel (SUSE-SU-2022:4072-1)
753051 SUSE Enterprise Linux Security Update for the Linux Kernel (SUSE-SU-2022:4589-1)
753063 SUSE Enterprise Linux Security Update for the Linux Kernel (SUSE-SU-2022:4617-1)