#VU94463 Use of uninitialized resource in Linux kernel - CVE-2022-48840
Vulnerability identifier: #VU94463
Vulnerability risk: Low
CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]
CVE-ID: CVE-2022-48840
CWE-ID:
CWE-908
Exploitation vector: Local
Exploit availability: No
Vulnerable software:
Linux kernel
Operating systems & Components /
Operating system
Vendor: Linux Foundation
Description
The vulnerability allows a local user to perform a denial of service (DoS) attack.
The vulnerability exists due to use of uninitialized resource within the iavf_remove() function in drivers/net/ethernet/intel/iavf/iavf_main.c. A local user can perform a denial of service (DoS) attack.
Mitigation
Install update from vendor's website.
Vulnerable software versions
Linux kernel: 5.15, 5.15 rc1, 5.15 rc2, 5.15 rc3, 5.15 rc4, 5.15 rc5, 5.15 rc6, 5.15 rc7, 5.15.0, 5.15.1, 5.15.2, 5.15.3, 5.15.4, 5.15.5, 5.15.6, 5.15.7, 5.15.8, 5.15.9, 5.15.10, 5.15.11, 5.15.12, 5.15.13, 5.15.14, 5.15.15, 5.15.16, 5.15.17, 5.15.18, 5.15.19, 5.15.20, 5.15.21, 5.15.22, 5.15.23, 5.15.24, 5.15.25, 5.15.26, 5.15.27, 5.15.28, 5.15.29, 5.15.30, 5.16, 5.16 rc1, 5.16 rc2, 5.16 rc3, 5.16 rc4, 5.16 rc5, 5.16 rc6, 5.16 rc8, 5.16.0, 5.16.1, 5.16.2, 5.16.3, 5.16.4, 5.16.5, 5.16.6, 5.16.7, 5.16.8, 5.16.9, 5.16.10, 5.16.11, 5.16.12, 5.16.13, 5.16.14, 5.16.15, 5.16.16, 5.17 rc1, 5.17 rc2, 5.17 rc3, 5.17 rc4, 5.17 rc5, 5.17 rc6, 5.17 rc7, 5.17 rc8, 5.17 rc9, 5.17 rc12
External links
https://git.kernel.org/stable/c/80974bb730270199c6fcb189af04d5945b87e813
https://git.kernel.org/stable/c/4477b9a4193b35eb3a8afd2adf2d42add2f88d57
https://git.kernel.org/stable/c/b04683ff8f0823b869c219c78ba0d974bddea0b5
https://mirrors.edge.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.15.31
https://mirrors.edge.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.16.17
https://mirrors.edge.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.17
Q & A
Can this vulnerability be exploited remotely?
No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
