CVE-2022-21505

Katalog CVE

CVSS 6.7 · Medium EPSS 0,20%

Kerentanan Origin Validation Error pada oracle linux. Skor CVSS 3.1 6.7 (Medium) menurut oracle.com.

Deskripsi (NVD)

In the linux kernel, if IMA appraisal is used with the "ima_appraise=log" boot param, lockdown can be defeated with kexec on any machine when Secure Boot is disabled or unavailable. IMA prevents setting "ima_appraise=log" from the boot param when Secure Boot is enabled, but this does not cover cases where lockdown is used without Secure Boot. CVSS 3.1 Base Score 6.7 (Confidentiality, Integrity, Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).

Rincian

Terbit di NVD

24 Desember 2024

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

6.7 (Medium), sumber oracle.com
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-346: Origin Validation Error

EPSS (30 hari)

0,20% peluang dieksploitasi; lebih tinggi dari 9,2% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://linux.oracle.com/cve/CVE-2022-21505.html advisory vendor
• https://git.kernel.org/linus/543ce63b664e2c2f9533d089a4664b559c3e6b5b broken link