Vulnerability identifier: #VU92960

Vulnerability risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-48758

CWE-ID: CWE-399

Exploitation vector: Local

Exploit availability: No

Vulnerable software:
Linux kernel
Operating systems & Components / Operating system

Vendor: Linux Foundation

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to resource management error within the bnx2fc_bind_pcidev(), bnx2fc_indicate_netevent(), bnx2fc_vport_destroy(), bnx2fc_if_create(), __bnx2fc_destroy(), bnx2fc_destroy_work() and bnx2fc_ulp_exit() functions in drivers/scsi/bnx2fc/bnx2fc_fcoe.c. A local user can perform a denial of service (DoS) attack.

Mitigation
Install update from vendor's website.

Vulnerable software versions

Linux kernel:

---

External links
http://git.kernel.org/stable/c/2a12fe8248a38437b95b942bbe85aced72e6e2eb
http://git.kernel.org/stable/c/262550f29c750f7876b6ed1244281e72b64ebffb
http://git.kernel.org/stable/c/c93a290c862ccfa404e42d7420565730d67cbff9
http://git.kernel.org/stable/c/de6336b17a1376db1c0f7a528cce8783db0881c0
http://git.kernel.org/stable/c/bf2bd892a0cb14dd2d21f2c658f4b747813be311
http://git.kernel.org/stable/c/00849de10f798a9538242824a51b1756e7110754
http://git.kernel.org/stable/c/b11e34f7bab21df36f02a5e54fb69e858c09a65d
http://git.kernel.org/stable/c/ace7b6ef41251c5fe47f629a9a922382fb7b0a6b
http://git.kernel.org/stable/c/847f9ea4c5186fdb7b84297e3eeed9e340e83fce

---

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.