GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

OESA-2022-1893 (CVE-2022-1462)

Vulnerability from osv_openeuler – Published: 2022-09-07 11:05 – Updated: 2026-08-06 11:05 – Source website
VLAI
Summary
kernel security update
Details

Security Fix(es):

An out-of-bounds read flaw was found in the Linux kernel’s TeleTYpe subsystem. The issue occurs in how a user triggers a race condition using ioctls TIOCSPTLCK and TIOCGPTPEER and TIOCSTI and TCXONC with leakage of memory in the flush_to_ldisc function. This flaw allows a local user to crash the system or read unauthorized random data from memory.(CVE-2022-1462)

Dm-verity is used for extending root-of-trust to root filesystems. LoadPin builds on this property to restrict module/firmware loads to just the trusted root filesystem. Device-mapper table reloads currently allow users with root privileges to switch out the target with an equivalent dm-linear target and bypass verification till reboot. This allows root to bypass LoadPin and can be used to load untrusted and unverified kernel modules and firmware, which implies arbitrary kernel execution and persistence for peripherals that do not verify firmware updates. We recommend upgrading past commit 4caae58406f8ceb741603eee460d79bacca9b1b5(CVE-2022-2503)

A race condition was found in the Linux kernel's watch queue due to a missing lock in pipe_resize_ring(). The specific flaw exists within the handling of pipe buffers. The issue results from the lack of proper locking when performing operations on an object. This flaw allows a local user to crash the system or escalate their privileges on the system.(CVE-2022-2959)

A flaw was found in the kernels implementation of proxied virtualized TPM devices. On a system where virtualized TPM devices are configured (this is not the default) a local attacker can create a use-after-free and create a situation where it may be possible to escalate privileges on the system.

References: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=9d8e7007dc7c4d7c8366739bbcd3f5e51dcd470f(CVE-2022-2977)

The linux kernels driver for the "ASIX AX88179_178A based USB 2.0/3.0 Gigabit Ethernet Devices" contains multiple out-of-bounds reads and possible writes in the ax88179_rx_fixup() function.

References:

https://www.spinics.net/lists/stable/msg536418.html

Upstream commit: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=57bc3d3ae8c14df3ceb4e17d26ddf9eeab304581(CVE-2022-2964)

A race condition was found in the Linux kernel's IP framework for transforming packets (XFRM subsystem) when multiple calls to xfrm_probe_algs occurred simultaneously. This flaw could allow a local attacker to potentially trigger an out-of-bounds write or leak kernel heap memory by performing an out-of-bounds read and copying it into a socket.(CVE-2022-3028)

Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References
To clipboard 

{
  "affected": [
    {
      "ecosystem_specific": {
        "aarch64": [
          "bpftool-5.10.0-60.54.0.82.oe2203.aarch64.rpm",
          "kernel-tools-devel-5.10.0-60.54.0.82.oe2203.aarch64.rpm",
          "kernel-tools-debuginfo-5.10.0-60.54.0.82.oe2203.aarch64.rpm",
          "kernel-5.10.0-60.54.0.82.oe2203.aarch64.rpm",
          "kernel-debugsource-5.10.0-60.54.0.82.oe2203.aarch64.rpm",
          "kernel-devel-5.10.0-60.54.0.82.oe2203.aarch64.rpm",
          "kernel-tools-5.10.0-60.54.0.82.oe2203.aarch64.rpm",
          "perf-debuginfo-5.10.0-60.54.0.82.oe2203.aarch64.rpm",
          "perf-5.10.0-60.54.0.82.oe2203.aarch64.rpm",
          "python3-perf-5.10.0-60.54.0.82.oe2203.aarch64.rpm",
          "kernel-source-5.10.0-60.54.0.82.oe2203.aarch64.rpm",
          "python3-perf-debuginfo-5.10.0-60.54.0.82.oe2203.aarch64.rpm",
          "bpftool-debuginfo-5.10.0-60.54.0.82.oe2203.aarch64.rpm",
          "kernel-headers-5.10.0-60.54.0.82.oe2203.aarch64.rpm",
          "kernel-debuginfo-5.10.0-60.54.0.82.oe2203.aarch64.rpm"
        ],
        "src": [
          "kernel-5.10.0-60.54.0.82.oe2203.src.rpm"
        ],
        "x86_64": [
          "kernel-tools-devel-5.10.0-60.54.0.82.oe2203.x86_64.rpm",
          "kernel-tools-5.10.0-60.54.0.82.oe2203.x86_64.rpm",
          "perf-5.10.0-60.54.0.82.oe2203.x86_64.rpm",
          "kernel-debugsource-5.10.0-60.54.0.82.oe2203.x86_64.rpm",
          "kernel-debuginfo-5.10.0-60.54.0.82.oe2203.x86_64.rpm",
          "perf-debuginfo-5.10.0-60.54.0.82.oe2203.x86_64.rpm",
          "python3-perf-debuginfo-5.10.0-60.54.0.82.oe2203.x86_64.rpm",
          "kernel-tools-debuginfo-5.10.0-60.54.0.82.oe2203.x86_64.rpm",
          "bpftool-debuginfo-5.10.0-60.54.0.82.oe2203.x86_64.rpm",
          "kernel-5.10.0-60.54.0.82.oe2203.x86_64.rpm",
          "kernel-headers-5.10.0-60.54.0.82.oe2203.x86_64.rpm",
          "kernel-source-5.10.0-60.54.0.82.oe2203.x86_64.rpm",
          "kernel-devel-5.10.0-60.54.0.82.oe2203.x86_64.rpm",
          "bpftool-5.10.0-60.54.0.82.oe2203.x86_64.rpm",
          "python3-perf-5.10.0-60.54.0.82.oe2203.x86_64.rpm"
        ]
      },
      "package": {
        "ecosystem": "openEuler:22.03-LTS",
        "name": "kernel",
        "purl": "pkg:rpm/openEuler/kernel\u0026distro=openEuler-22.03-LTS"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "5.10.0-60.54.0.82.oe2203"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "database_specific": {
    "severity": "High"
  },
  "details": "\r\n\r\nSecurity Fix(es):\r\n\r\nAn out-of-bounds read flaw was found in the Linux kernel\u2019s TeleTYpe subsystem. The issue occurs in how a user triggers a race condition using ioctls TIOCSPTLCK and TIOCGPTPEER and TIOCSTI and TCXONC with leakage of memory in the flush_to_ldisc function. This flaw allows a local user to crash the system or read unauthorized random data from memory.(CVE-2022-1462)\r\n\r\nDm-verity is used for extending root-of-trust to root filesystems. LoadPin builds on this property to restrict module/firmware loads to just the trusted root filesystem. Device-mapper table reloads currently allow users with root privileges to switch out the target with an equivalent dm-linear target and bypass verification till reboot. This allows root to bypass LoadPin and can be used to load untrusted and unverified kernel modules and firmware, which implies arbitrary kernel execution and persistence for peripherals that do not verify firmware updates. We recommend upgrading past commit 4caae58406f8ceb741603eee460d79bacca9b1b5(CVE-2022-2503)\r\n\r\nA race condition was found in the Linux kernel\u0026apos;s watch queue due to a missing lock in pipe_resize_ring(). The specific flaw exists within the handling of pipe buffers. The issue results from the lack of proper locking when performing operations on an object. This flaw allows a local user to crash the system or escalate their privileges on the system.(CVE-2022-2959)\r\n\r\nA flaw was found in the kernels implementation of proxied virtualized TPM devices.  On a system where virtualized TPM devices are configured (this is not the default) a local attacker can create a use-after-free and create a situation where it may be possible to escalate privileges on the system.\r\n\r\nReferences:\nhttps://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=9d8e7007dc7c4d7c8366739bbcd3f5e51dcd470f(CVE-2022-2977)\r\n\r\nThe linux kernels driver for the \u0026quot;ASIX AX88179_178A based USB 2.0/3.0 Gigabit Ethernet Devices\u0026quot; contains multiple out-of-bounds reads and possible writes in the ax88179_rx_fixup() function. \r\n\r\n\nReferences:\r\n\r\nhttps://www.spinics.net/lists/stable/msg536418.html\r\n\r\nUpstream commit:\nhttps://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=57bc3d3ae8c14df3ceb4e17d26ddf9eeab304581(CVE-2022-2964)\r\n\r\nA race condition was found in the Linux kernel\u0026apos;s IP framework for transforming packets (XFRM subsystem) when multiple calls to xfrm_probe_algs occurred simultaneously. This flaw could allow a local attacker to potentially trigger an out-of-bounds write or leak kernel heap memory by performing an out-of-bounds read and copying it into a socket.(CVE-2022-3028)",
  "id": "OESA-2022-1893",
  "modified": "2026-08-06T11:05:10Z",
  "published": "2022-09-07T11:05:10Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2022-1893"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-1462"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-2503"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-2959"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-2977"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-2964"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-3028"
    }
  ],
  "schema_version": "1.7.2",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "kernel security update",
  "upstream": [
    "CVE-2022-1462",
    "CVE-2022-2503",
    "CVE-2022-2959",
    "CVE-2022-2977",
    "CVE-2022-2964",
    "CVE-2022-3028"
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.