Home > Vulnerability Database > CVE-2022-3028

Mend.io Vulnerability Database

CVE-2022-3028

Date: August 31, 2022

A race condition was found in the Linux kernel's IP framework for transforming packets (XFRM subsystem) when multiple calls to xfrm_probe_algs occurred simultaneously. This flaw could allow a local attacker to potentially trigger an out-of-bounds write or leak kernel heap memory by performing an out-of-bounds read and copying it into a socket.

Severity Score

7.0

Related Resources (13)

Url: https://lore.kernel.org/all/YtoWqEkKzvimzWS5@gondor.apana.org.au/T/

Url: https://access.redhat.com/security/cve/CVE-2022-3028

Url: https://security-tracker.debian.org/tracker/CVE-2022-3028

Url: https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/F3MYP7WX4PNE6RCITVXA43CECBZT4CL6/

Url: https://people.canonical.com/~ubuntu-security/cve/CVE-2022-3028

Url: https://nvd.nist.gov/vuln/detail/CVE-2022-3028

Url: https://github.com/torvalds/linux/commit/ba953a9d89a00c078b85f4b190bc1dde66fe16b5

Url: https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PEQYVCNYUWB4CJ2YRAYNF2GGFQ7SUYC4/

Url: https://security.netapp.com/advisory/ntap-20230214-0004/

Url: https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JKVA75UHKVOHNOEPCLUHTFGWCOOUBDM3/

Url: https://lists.debian.org/debian-lts-announce/2022/10/msg00000.html

Url: https://lists.debian.org/debian-lts-announce/2022/11/msg00001.html

Url: https://www.mend.io/vulnerability-database/CVE-2022-3028

Severity Score

7.0

Weakness Type (CWE)

Out-of-bounds Write

CWE-787

Race Conditions

CWE-362

Out-of-bounds Read

CWE-125

Improper Locking

CWE-667

CVSS v3.1

Base Score:	7.0
Attack Vector (AV):	LOCAL
Attack Complexity (AC):	HIGH
Privileges Required (PR):	LOW
User Interaction (UI):	NONE
Scope (S):	UNCHANGED
Confidentiality (C):	HIGH
Integrity (I):	HIGH
Availability (A):	HIGH

Mend.io Vulnerability Database

We found results for “”

CVE-2022-3028

Date: August 31, 2022

Severity Score

Related Resources (13)

Severity Score

Weakness Type (CWE)

CVSS v3.1

Do you need more information?