#VU104708 Improper locking in Linux kernel - CVE-2022-49151

Vulnerability identifier: #VU104708

Vulnerability risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2022-49151

CWE-ID: CWE-667

Exploitation vector: Local

Exploit availability: No

Vulnerable software:
Linux kernel
Operating systems & Components / Operating system

Vendor: Linux Foundation

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the mcba_usb_xmit(), mcba_usb_read_bulk_callback(), mcba_usb_start() and mcba_usb_probe() functions in drivers/net/can/usb/mcba_usb.c. A local user can perform a denial of service (DoS) attack.

Mitigation
Install update from vendor's website.

Vulnerable software versions

Linux kernel: All versions

---

External links
https://git.kernel.org/stable/c/136bed0bfd3bc9c95c88aafff2d22ecb3a919f23
https://git.kernel.org/stable/c/5598442edc29e8f6f2380e4b471dc1a3fcd80508
https://git.kernel.org/stable/c/88272b4a37913bdf6f339162a7920bd8e9b49de2
https://git.kernel.org/stable/c/b48d1bb3f1ca337ad653022aefb5a40a47dfe5cd
https://git.kernel.org/stable/c/cbd110b8dd7ad763bf413f71c0484116ae9302d4
https://git.kernel.org/stable/c/ef0acc514123140157b19a9ff2e2de5d91d612bc
https://git.kernel.org/stable/c/f2ec3cd0f34f8c3f94bc21fbba14868301c9c49d
https://git.kernel.org/stable/c/fa9c1f14002dc0d5293e16a2007bd89b6e79207b

---

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.