#VU99182 Incorrect calculation in Linux kernel - CVE-2022-49014

Vulnerability identifier: #VU99182

Vulnerability risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2022-49014

CWE-ID: CWE-682

Exploitation vector: Local

Exploit availability: No

Vulnerable software:
Linux kernel
Operating systems & Components / Operating system

Vendor: Linux Foundation

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to incorrect calculation within the __tun_detach() and tun_detach() functions in drivers/net/tun.c. A local user can perform a denial of service (DoS) attack.

Mitigation
Install update from vendor's website.

Vulnerable software versions

Linux kernel: All versions

---

External links
https://git.kernel.org/stable/c/1f23f1890d91812c35d32eab1b49621b6d32dc7b
https://git.kernel.org/stable/c/16c244bc65d1175775325ec0489a5a5c830e02c7
https://git.kernel.org/stable/c/5f442e1d403e0496bacb74a58e2be7f500695e6f
https://git.kernel.org/stable/c/04b995e963229501401810dab89dc73e7f12d054
https://git.kernel.org/stable/c/4cde8da2d814a3b7b176db81922d4ddaad7c0f0e
https://git.kernel.org/stable/c/5daadc86f27ea4d691e2131c04310d0418c6cd12

---

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.