#VU104837 Race condition within a thread in Linux kernel - CVE-2022-49641

Vulnerability identifier: #VU104837

Vulnerability risk: Low

CVSSv4.0: 1.1 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2022-49641

CWE-ID: CWE-366

Exploitation vector: Local

Exploit availability: No

Vulnerable software:
Linux kernel
Operating systems & Components / Operating system

Vendor: Linux Foundation

Description

The vulnerability allows a local user to corrupt data.

The vulnerability exists due to a data race within the do_proc_douintvec_conv() function in kernel/sysctl.c. A local user can corrupt data.

Mitigation
Install update from vendor's website.

Vulnerable software versions

Linux kernel: All versions

---

External links
https://git.kernel.org/stable/c/4762b532ec9539755aab61445d5da6e1926ccb99
https://git.kernel.org/stable/c/630c76850d554d7140232e71b5d1663e88cffb54
https://git.kernel.org/stable/c/d335db59f7fb3353f56e52371f1ee796ae9c8f09
https://git.kernel.org/stable/c/d5d54714e329f646bd7af4994fc427d88ee68936

---

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.