Vulnerability identifier: #VU94455

Vulnerability risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-48786

CWE-ID: CWE-667

Exploitation vector: Local

Exploit availability: No

Vulnerable software:
Linux kernel
Operating systems & Components / Operating system

Vendor: Linux Foundation

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the vsock_stream_connect() function in net/vmw_vsock/af_vsock.c. A local user can perform a denial of service (DoS) attack.

Mitigation
Install update from vendor's website.

Vulnerable software versions

Linux kernel:

---

External links
http://git.kernel.org/stable/c/0bb88f3f7e8d506f3efe46d694964117e20efbfc
http://git.kernel.org/stable/c/e3b3939fd137aab6d00d54bee0ee9244b286a608
http://git.kernel.org/stable/c/2910bcb9f67551a45397735e47b6d456eb8cd549
http://git.kernel.org/stable/c/5f326fe2aef411a6575628f92bd861463ea91df7
http://git.kernel.org/stable/c/87cd1bbd6677411e17369cd4b7389ab1e1fdba44
http://git.kernel.org/stable/c/787468ee7a435777521d33399d012fd591ae2f94
http://git.kernel.org/stable/c/addd62a8cb6fa90aa322365c62487da61f6baab8
http://git.kernel.org/stable/c/b9208492fcaecff8f43915529ae34b3bcb03877c

---

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.