CVE-2022-2991

Katalog CVE

CVSS 6.7 · Medium EPSS 0,45%

Kerentanan Heap-based Buffer Overflow pada linux kernel. Skor CVSS 3.1 6.7 (Medium) menurut NVD.

Deskripsi (NVD)

A heap-based buffer overflow was found in the Linux kernel's LightNVM subsystem. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length heap-based buffer. This vulnerability allows a local attacker to escalate privileges and execute arbitrary code in the context of the kernel. The attacker must first obtain the ability to execute high-privileged code on the target system to exploit this vulnerability.

Rincian

Terbit di NVD

25 Agustus 2022

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

6.7 (Medium), sumber NVD
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-122: Heap-based Buffer Overflow
CWE-787: Out-of-bounds Write

EPSS (30 hari)

0,45% peluang dieksploitasi; lebih tinggi dari 36,9% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/drivers/lightnvm/Kconfig?h=v5.10.114&i... mailing list · patch · advisory vendor
• https://www.zerodayinitiative.com/advisories/ZDI-22-960/ advisory pihak ketiga · vdb entry