CVE-2022-3028
Summary
| CVE | CVE-2022-3028 |
|---|---|
| State | PUBLIC |
| Assigner | [email protected] |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2022-08-31 16:15:00 UTC |
| Updated | 2023-11-07 03:50:00 UTC |
| Description | A race condition was found in the Linux kernel's IP framework for transforming packets (XFRM subsystem) when multiple calls to xfrm_probe_algs occurred simultaneously. This flaw could allow a local attacker to potentially trigger an out-of-bounds write or leak kernel heap memory by performing an out-of-bounds read and copying it into a socket. |
Risk And Classification
Problem Types: CWE-362 | CWE-787
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Operating System | Debian | Debian Linux | 10.0 | All | All | All |
| Operating System | Fedoraproject | Fedora | 35 | All | All | All |
| Operating System | Fedoraproject | Fedora | 36 | All | All | All |
| Operating System | Fedoraproject | Fedora | 37 | All | All | All |
| Operating System | Linux | Linux Kernel | All | All | All | All |
| Operating System | Linux | Linux Kernel | 6.0 | rc1 | All | All |
| Operating System | Linux | Linux Kernel | 6.0 | rc2 | All | All |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| Re: Race 1 in net/xfrm/xfrm_algo.c | MISC | lore.kernel.org | |
| August 2022 Linux Kernel 5.19 Vulnerabilities in NetApp Products | NetApp Product Security | CONFIRM | security.netapp.com | |
| [SECURITY] [DLA 3131-1] linux security update | MLIST | lists.debian.org | |
| [SECURITY] Fedora 36 Update: kernel-5.19.6-200.fc36 - package-announce - Fedora Mailing-Lists | lists.fedoraproject.org | ||
| [SECURITY] Fedora 35 Update: kernel-5.19.6-100.fc35 - package-announce - Fedora Mailing-Lists | lists.fedoraproject.org | ||
| [SECURITY] Fedora 37 Update: kernel-tools-5.19.4-300.fc37 - package-announce - Fedora Mailing-Lists | lists.fedoraproject.org | ||
| [SECURITY] [DLA 3173-1] linux-5.10 security update | MLIST | lists.debian.org | |
| Re: Race 1 in net/xfrm/xfrm_algo.c | lore.kernel.org | ||
| [SECURITY] Fedora 37 Update: kernel-tools-5.19.4-300.fc37 - package-announce - Fedora Mailing-Lists | FEDORA | lists.fedoraproject.org | |
| [SECURITY] Fedora 35 Update: kernel-5.19.6-100.fc35 - package-announce - Fedora Mailing-Lists | FEDORA | lists.fedoraproject.org | |
| af_key: Do not call xfrm_probe_algs in parallel · torvalds/linux@ba953a9 · GitHub | MISC | github.com | |
| [SECURITY] Fedora 36 Update: kernel-5.19.6-200.fc36 - package-announce - Fedora Mailing-Lists | FEDORA | lists.fedoraproject.org | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
Legacy QID Mappings
- 160123 Oracle Enterprise Linux Security Update for unbreakable enterprise kernel (ELSA-2022-9852)
- 160135 Oracle Enterprise Linux Security Update for unbreakable enterprise kernel-container (ELSA-2022-9871)
- 160136 Oracle Enterprise Linux Security Update for unbreakable enterprise kernel (ELSA-2022-9870)
- 160147 Oracle Enterprise Linux Security Update for unbreakable enterprise kernel (ELSA-2022-9926)
- 160150 Oracle Enterprise Linux Security Update for unbreakable enterprise kernel-container (ELSA-2022-9927)
- 160161 Oracle Enterprise Linux Security Update for unbreakable enterprise kernel-container (ELSA-2022-9931)
- 160164 Oracle Enterprise Linux Security Update for unbreakable enterprise kernel (ELSA-2022-9930)
- 160212 Oracle Enterprise Linux Security Update for unbreakable enterprise kernel (ELSA-2022-9998)
- 160239 Oracle Enterprise Linux Security Update for unbreakable enterprise kernel-container (ELSA-2022-9999)
- 160583 Oracle Enterprise Linux Security Update for kernel (ELSA-2023-2458)
- 160692 Oracle Enterprise Linux Security Update for kernel (ELSA-2023-2951)
- 181039 Debian Security Update for linux (CVE-2022-3028)
- 181091 Debian Security Update for linux (DLA 3131-1)
- 181190 Debian Security Update for linux-5.10 (DLA 3173-1)
- 198999 Ubuntu Security Notification for Linux kernel (OEM) Vulnerabilities (USN-5693-1)
- 199029 Ubuntu Security Notification for Linux kernel Vulnerabilities (USN-5728-1)
- 199030 Ubuntu Security Notification for Linux kernel Vulnerabilities (USN-5727-1)
- 199031 Ubuntu Security Notification for Linux kernel Vulnerabilities (USN-5729-1)
- 199036 Ubuntu Security Notification for Linux kernel (GCP) Vulnerabilities (USN-5727-2)
- 199037 Ubuntu Security Notification for Linux kernel Vulnerabilities (USN-5728-2)
- 199038 Ubuntu Security Notification for Linux kernel Vulnerabilities (USN-5729-2)
- 199051 Ubuntu Security Notification for Linux kernel (GCP) Vulnerabilities (USN-5728-3)
- 199072 Ubuntu Security Notification for Linux kernel (Azure) Vulnerabilities (USN-5774-1)
- 241417 Red Hat Update for kernel security (RHSA-2023:2458)
- 241468 Red Hat Update for kernel-rt (RHSA-2023:2148)
- 241504 Red Hat Update for kernel security (RHSA-2023:2951)
- 241527 Red Hat Update for kernel-rt (RHSA-2023:2736)
- 242855 Red Hat Update for kernel (RHSA-2024:0412)
- 283080 Fedora Security Update for kernel (FEDORA-2022-6835ddb6d8)
- 283081 Fedora Security Update for kernel (FEDORA-2022-35c14ba5bb)
- 354071 Amazon Linux Security Advisory for kernel : ALAS-2022-1636
- 354075 Amazon Linux Security Advisory for kernel : ALAS2-2022-1852
- 354081 Amazon Linux Security Advisory for kernel : ALAS2KERNEL-5.4-2022-036
- 354082 Amazon Linux Security Advisory for kernel : ALAS2KERNEL-5.15-2022-008
- 354084 Amazon Linux Security Advisory for kernel : ALAS2KERNEL-5.10-2022-020
- 354439 Amazon Linux Security Advisory for kernel : ALAS2022-2022-150
- 354468 Amazon Linux Security Advisory for kernel : ALAS2022-2022-185
- 354542 Amazon Linux Security Advisory for kernel : ALAS-2022-185
- 355199 Amazon Linux Security Advisory for kernel : ALAS2023-2023-070
- 377891 Alibaba Cloud Linux Security Update for cloud-kernel (ALINUX3-SA-2023:0002)
- 378043 Alibaba Cloud Linux Security Update for cloud-kernel (ALINUX2-SA-2023:0011)
- 378468 Alibaba Cloud Linux Security Update for cloud-kernel (ALINUX3-SA-20230042)
- 378512 Alibaba Cloud Linux Security Update for cloud-kernel (ALINUX3-SA-2023:0042)
- 390268 Oracle VM Server for x86 Security Update for kernel (OVMSA-2022-0026)
- 591406 Siemens SIMATIC S7-1500 CPU GNU/Linux subsystem Multiple Vulnerabilities (SSB-439005, ICSA-22-104-13)
- 6140169 AWS Bottlerocket Security Update for kernel (GHSA-c274-x72q-qpf2)
- 672278 EulerOS Security Update for kernel (EulerOS-SA-2022-2686)
- 672354 EulerOS Security Update for kernel (EulerOS-SA-2022-2732)
- 672391 EulerOS Security Update for kernel (EulerOS-SA-2022-2767)
- 672410 EulerOS Security Update for kernel (EulerOS-SA-2022-2796)
- 672474 EulerOS Security Update for kernel (EulerOS-SA-2022-2823)
- 672711 EulerOS Security Update for kernel (EulerOS-SA-2023-1507)
- 752584 SUSE Enterprise Linux Security Update for the Linux Kernel (SUSE-SU-2022:3265-1)
- 752589 SUSE Enterprise Linux Security Update for the Linux Kernel (SUSE-SU-2022:3264-1)
- 752591 SUSE Enterprise Linux Security Update for the Linux Kernel (SUSE-SU-2022:3274-1)
- 752592 SUSE Enterprise Linux Security Update for the Linux Kernel (SUSE-SU-2022:3282-1)
- 752594 SUSE Enterprise Linux Security Update for the Linux Kernel (SUSE-SU-2022:3293-1)
- 752596 SUSE Enterprise Linux Security Update for the Linux Kernel (SUSE-SU-2022:3291-1)
- 752615 SUSE Enterprise Linux Security Update for the Linux Kernel (SUSE-SU-2022:3408-1)
- 752632 SUSE Enterprise Linux Security Update for the Linux Kernel (SUSE-SU-2022:3450-1)
- 753063 SUSE Enterprise Linux Security Update for the Linux Kernel (SUSE-SU-2022:4617-1)
- 753167 SUSE Enterprise Linux Security Update for the Linux Kernel (SUSE-SU-2022:3288-1)
- 753370 SUSE Enterprise Linux Security Update for the Linux Kernel (SUSE-SU-2022:3609-1)
- 753374 SUSE Enterprise Linux Security Update for the Linux Kernel (SUSE-SU-2022:3809-1)
- 753703 SUSE Enterprise Linux Security Update for the Linux Kernel (SUSE-SU-2023:0416-1)
- 753707 SUSE Enterprise Linux Security Update for the Linux Kernel (SUSE-SU-2023:0416-1)
- 753727 SUSE Enterprise Linux Security Update for the Linux Kernel (SUSE-SU-2023:0416-1)
- 903761 Common Base Linux Mariner (CBL-Mariner) Security Update for kernel (10814)
- 903874 Common Base Linux Mariner (CBL-Mariner) Security Update for kernel (10822)
- 904110 Common Base Linux Mariner (CBL-Mariner) Security Update for kernel (10814-1)
- 904140 Common Base Linux Mariner (CBL-Mariner) Security Update for kernel (10822-1)
- 905902 Common Base Linux Mariner (CBL-Mariner) Security Update for kernel (10814-2)
- 906453 Common Base Linux Mariner (CBL-Mariner) Security Update for kernel (10822-2)
- 941023 AlmaLinux Security Update for kernel (ALSA-2023:2458)
- 941061 AlmaLinux Security Update for kernel-rt (ALSA-2023:2148)
- 941096 AlmaLinux Security Update for kernel (ALSA-2023:2951)
- 941114 AlmaLinux Security Update for kernel-rt (ALSA-2023:2736)