Linux Kernel transport.c j1939_session_destroy memory leak

Summary

CVE	CVE-2022-3633
State	PUBLISHED
Assigner	VulDB
Source Priority	CVE Program / NVD first with legacy fallback
Published	2022-10-21 11:15:09 UTC
Updated	2026-10-14 14:17:26 UTC
Description	A vulnerability classified as problematic has been found in Linux Kernel. Affected is the function j1939_session_destroy of the file net/can/j1939/transport.c. The manipulation leads to memory leak. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-211932.

Risk And Classification

Primary CVSS: v3.1 3.3 LOW from [email protected]

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

Problem Types: CWE-401 | CWE-401 CWE-401 Memory Leak

Version	Source	Type	Score	Severity	Vector
3.1	[email protected]	Primary	3.3	LOW	`CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L`
3.1	[email protected]	Secondary	3.5	LOW	`CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L`
3.1	CNA	DECLARED	3.5	LOW	`CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L`
3.0	CNA	DECLARED	3.5	LOW	`CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L`
2.0	[email protected]	Secondary	2.7		`AV:A/AC:L/Au:S/C:N/I:N/A:P`
2.0	CNA	DECLARED	2.7		`AV:A/AC:L/Au:S/C:N/I:N/A:P`

CVSS v3.1 Breakdown

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

Low

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

CVSS v3.0 Breakdown

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

Low

CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

CVSS v2.0 Breakdown

Access Vector

Adjacent

Access Complexity

Low

Authentication

Single

Confidentiality

None

Integrity

None

Availability

Partial

AV:A/AC:L/Au:S/C:N/I:N/A:P

NVD Known Affected Configurations (CPE 2.3)

Type	Vendor	Product	Version	Update	Edition	Language
Operating System	Debian	Debian Linux	10.0	All	All	All
Operating System	Linux	Linux Kernel	-	All	All	All

Vendor Declared Affected Products

Source	Vendor	Product	Version	Platforms
CNA	Linux	Kernel	affected n/a	Not specified
ADP	Siemens	SIMATIC S7-1500 TM MFP - GNU/Linux Subsystem	affected V1.1 custom	Not specified

References

Reference	Source	Link	Tags
CVE-2022-3633 \| Linux Kernel transport.c j1939_session_destroy memory leak (DLA 3173-1)	af854a3a-2127-422b-91ae-364da2661108	vuldb.com	Third Party Advisory
kernel/git/klassert/ipsec-next.git - Steffen Klassert's ipsec-next networking tree	af854a3a-2127-422b-91ae-364da2661108	git.kernel.org	Mailing List, Patch, Vendor Advisory
cert-portal.siemens.com/productcert/html/ssa-794697.html	0b142b55-0307-4c5a-b3c9-f314f3fb7c5e	cert-portal.siemens.com
CVE-2022-3633 \| Linux Kernel IPsec transport.c j1939_session_destroy memory leak	af854a3a-2127-422b-91ae-364da2661108	vuldb.com	Third Party Advisory
[SECURITY] [DLA 3173-1] linux-5.10 security update	MITRE	lists.debian.org
CVE Program record	CVE.ORG	www.cve.org	canonical
NVD vulnerability detail	NVD	nvd.nist.gov	canonical, analysis

No vendor comments have been submitted for this CVE.

Additional Advisory Data

Source	Time	Event
CNA	2022-10-21T00:00:00.000Z	Advisory disclosed
CNA	2022-10-21T00:00:00.000Z	CVE reserved
CNA	2022-10-21T02:00:00.000Z	VulDB entry created
CNA	2023-01-03T12:45:09.000Z	VulDB entry last update

Legacy QID Mappings

181154 Debian Security Update for linux (CVE-2022-3633)
181190 Debian Security Update for linux-5.10 (DLA 3173-1)
377891 Alibaba Cloud Linux Security Update for cloud-kernel (ALINUX3-SA-2023:0002)
378468 Alibaba Cloud Linux Security Update for cloud-kernel (ALINUX3-SA-20230042)
378512 Alibaba Cloud Linux Security Update for cloud-kernel (ALINUX3-SA-2023:0042)
752911 SUSE Enterprise Linux Security Update for the Linux Kernel (SUSE-SU-2022:3998-1)
752913 SUSE Enterprise Linux Security Update for the Linux Kernel (SUSE-SU-2022:4072-1)
753063 SUSE Enterprise Linux Security Update for the Linux Kernel (SUSE-SU-2022:4617-1)