7

CVE-2022-1729

A race condition was found the Linux kernel in perf_event_open() which can be exploited by an unprivileged user to gain root privileges. The bug allows to build several exploit primitives such as kernel address information leak, arbitrary execution, etc.

Data is provided by the National Vulnerability Database (NVD)
Linux ≫ Linux Kernel Version >= 3.2.85 < 3.3
Linux ≫ Linux Kernel Version >= 3.16.40 < 3.17
Linux ≫ Linux Kernel Version >= 3.18.54 < 3.19
Linux ≫ Linux Kernel Version >= 4.0.0 < 4.9.316
Linux ≫ Linux Kernel Version >= 4.10 < 4.14.281
Linux ≫ Linux Kernel Version >= 4.15 < 4.19.245
Linux ≫ Linux Kernel Version >= 4.20 < 5.4.196
Linux ≫ Linux Kernel Version >= 5.5.0 < 5.10.118
Linux ≫ Linux Kernel Version >= 5.11 < 5.15.42
Linux ≫ Linux Kernel Version >= 5.16 < 5.17.10
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Type Source Score Percentile
EPSS FIRST.org 0.1% 0.291
CVSS Metriken
Source Base Score Exploit Score Impact Score Vector string
nvd@nist.gov 7 1 5.9
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

The product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently.

CWE-366 Race Condition within a Thread

If two threads of execution use a resource simultaneously, there exists the possibility that resources may be used while invalid, in turn making the state of execution undefined.

https://www.openwall.com/lists/oss-security/2022/05/20/2
Patch
Third Party Advisory
Mailing List