A heap buffer overflow flaw was found in IPsec ESP transformation code in net/ipv4/esp4.c and net/ipv6/esp6.c. This flaw allows a local attacker with a normal user privilege to overwrite kernel heap objects and may cause a local privilege escalation threat.
References
Link | Resource |
---|---|
https://bugzilla.redhat.com/show_bug.cgi?id=2061633 | Issue Tracking Patch Third Party Advisory |
https://github.com/torvalds/linux/commit/ebe48d368e97d007bfeb76fcb065d6cfc4c96645 | Patch Third Party Advisory |
https://security.netapp.com/advisory/ntap-20220429-0001/ | Third Party Advisory |
https://www.debian.org/security/2022/dsa-5127 | Third Party Advisory |
https://www.debian.org/security/2022/dsa-5173 | Third Party Advisory |
Configurations
Configuration 1 (hide)
|
Configuration 2 (hide)
|
Configuration 3 (hide)
|
Configuration 4 (hide)
AND |
|
Configuration 5 (hide)
AND |
|
Configuration 6 (hide)
AND |
|
Configuration 7 (hide)
AND |
|
Configuration 8 (hide)
AND |
|
Configuration 9 (hide)
AND |
|
Configuration 10 (hide)
AND |
|
Configuration 11 (hide)
AND |
|
Configuration 12 (hide)
|
History
01 Feb 2023, 14:32
Type | Values Removed | Values Added |
---|---|---|
CPE | cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* |
|
References | (DEBIAN) https://www.debian.org/security/2022/dsa-5173 - Third Party Advisory | |
First Time |
Debian
Debian debian Linux |
04 Jul 2022, 11:15
Type | Values Removed | Values Added |
---|---|---|
References |
|
10 May 2022, 15:25
Type | Values Removed | Values Added |
---|---|---|
CPE | cpe:2.3:h:netapp:h700e:-:*:*:*:*:*:*:* cpe:2.3:o:netapp:h410s_firmware:-:*:*:*:*:*:*:* cpe:2.3:h:netapp:h500e:-:*:*:*:*:*:*:* cpe:2.3:h:netapp:h700s:-:*:*:*:*:*:*:* cpe:2.3:h:netapp:h500s:-:*:*:*:*:*:*:* cpe:2.3:h:netapp:h410s:-:*:*:*:*:*:*:* cpe:2.3:h:netapp:h300e:-:*:*:*:*:*:*:* cpe:2.3:o:netapp:h410c_firmware:-:*:*:*:*:*:*:* cpe:2.3:o:netapp:h700e_firmware:-:*:*:*:*:*:*:* cpe:2.3:o:netapp:h500e_firmware:-:*:*:*:*:*:*:* cpe:2.3:h:netapp:h300s:-:*:*:*:*:*:*:* cpe:2.3:o:netapp:h500s_firmware:-:*:*:*:*:*:*:* cpe:2.3:o:netapp:h700s_firmware:-:*:*:*:*:*:*:* cpe:2.3:h:netapp:h410c:-:*:*:*:*:*:*:* cpe:2.3:o:netapp:h300e_firmware:-:*:*:*:*:*:*:* cpe:2.3:o:netapp:h300s_firmware:-:*:*:*:*:*:*:* |
|
First Time |
Netapp h300s
Netapp h300s Firmware Netapp h300e Netapp h700s Firmware Netapp h410s Netapp h500e Netapp h410c Netapp h700e Netapp h410s Firmware Netapp h700s Netapp Netapp h410c Firmware Netapp h500s Netapp h500e Firmware Netapp h700e Firmware Netapp h300e Firmware Netapp h500s Firmware |
|
References | (CONFIRM) https://security.netapp.com/advisory/ntap-20220429-0001/ - Third Party Advisory | |
References | (DEBIAN) https://www.debian.org/security/2022/dsa-5127 - Third Party Advisory |
03 May 2022, 11:15
Type | Values Removed | Values Added |
---|---|---|
References |
|
29 Apr 2022, 14:15
Type | Values Removed | Values Added |
---|---|---|
References |
|
29 Mar 2022, 19:23
Type | Values Removed | Values Added |
---|---|---|
CWE | CWE-787 | |
CPE | cpe:2.3:o:linux:linux_kernel:5.17:rc7:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:5.17:rc6:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:5.17:rc4:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:5.17:-:*:*:*:*:*:* cpe:2.3:a:redhat:virtualization:4.0:*:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:5.17:rc5:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:5.17:rc3:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:* cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:5.17:rc2:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:5.17:rc1:*:*:*:*:*:* cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:* |
|
CVSS |
v2 : v3 : |
v2 : 4.6
v3 : 7.8 |
References | (MISC) https://github.com/torvalds/linux/commit/ebe48d368e97d007bfeb76fcb065d6cfc4c96645 - Patch, Third Party Advisory | |
References | (MISC) https://bugzilla.redhat.com/show_bug.cgi?id=2061633 - Issue Tracking, Patch, Third Party Advisory | |
First Time |
Linux linux Kernel
Fedoraproject fedora Redhat enterprise Linux Linux Redhat Redhat virtualization Fedoraproject |
25 Mar 2022, 19:15
Type | Values Removed | Values Added |
---|---|---|
References |
|
|
Summary | A heap buffer overflow flaw was found in IPsec ESP transformation code in net/ipv4/esp4.c and net/ipv6/esp6.c. This flaw allows a local attacker with a normal user privilege to overwrite kernel heap objects and may cause a local privilege escalation threat. |
23 Mar 2022, 14:15
Type | Values Removed | Values Added |
---|---|---|
Summary | In the Linux kernel before 5.16.15, there is a buffer overflow in ESP transformation in net/ipv4/esp4.c and net/ipv6/esp6.c via a large message. In some configurations, local users can gain privileges by overwriting kernel heap objects. | |
References |
|
23 Mar 2022, 06:15
Type | Values Removed | Values Added |
---|---|---|
New CVE |
Information
Published : 2022-03-23 06:15
Updated : 2023-12-10 14:22
NVD link : CVE-2022-27666
Mitre link : CVE-2022-27666
CVE.ORG link : CVE-2022-27666
JSON object : View
Products Affected
netapp
- h700s_firmware
- h700e
- h700e_firmware
- h700s
- h300s_firmware
- h300s
- h300e
- h500e_firmware
- h410c_firmware
- h500s
- h410c
- h410s
- h410s_firmware
- h500s_firmware
- h300e_firmware
- h500e
debian
- debian_linux
linux
- linux_kernel
fedoraproject
- fedora
redhat
- virtualization
- enterprise_linux
CWE
CWE-787
Out-of-bounds Write