Race condition within a thread in Linux kernel

1) Race condition within a thread

EUVDB-ID: #VU104837

Risk: Low

CVSSv4.0: 1.1 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2022-49641

CWE-ID: CWE-366 - Race Condition within a Thread

Exploit availability: No

Description

The vulnerability allows a local user to corrupt data.

The vulnerability exists due to a data race within the do_proc_douintvec_conv() function in kernel/sysctl.c. A local user can corrupt data.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Linux kernel: All versions

CPE2.3

• cpe:2.3:o:linux_foundation:linux_kernel:*:*:*:*:*:*:*:*

External links

https://git.kernel.org/stable/c/4762b532ec9539755aab61445d5da6e1926ccb99
https://git.kernel.org/stable/c/630c76850d554d7140232e71b5d1663e88cffb54
https://git.kernel.org/stable/c/d335db59f7fb3353f56e52371f1ee796ae9c8f09
https://git.kernel.org/stable/c/d5d54714e329f646bd7af4994fc427d88ee68936

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.