CVE-2022-49919

In the Linux kernel, the following vulnerability has been resolved:

netfilter: nf_tables: release flow rule object from commit path

No need to postpone this to the commit release path, since no packets
are walking over this object, this is accessed from control plane only.
This helped uncovered UAF triggered by races with the netlink notifier.
Race Condition
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
7 HIGH
LOCAL
HIGH
LOW
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
LinuxCNA
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 1%
VendorProductVersion
linuxlinux_kernel
5.4.198 ≤
𝑥
< 5.4.224
linuxlinux_kernel
5.10.122 ≤
𝑥
< 5.10.154
linuxlinux_kernel
5.15.47 ≤
𝑥
< 5.15.78
linuxlinux_kernel
5.17.15 ≤
𝑥
< 5.18
linuxlinux_kernel
5.18.4 ≤
𝑥
< 6.0.8
linuxlinux_kernel
6.1:rc1
linuxlinux_kernel
6.1:rc2
linuxlinux_kernel
6.1:rc3
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
linux
bullseye
5.10.223-1
fixed
bullseye (security)
5.10.234-1
fixed
bookworm
6.1.129-1
fixed
bookworm (security)
6.1.135-1
fixed
trixie
6.12.22-1
fixed
sid
6.12.25-1
fixed
Common Weakness Enumeration
Vulnerability Media Exposure
References
https://git.kernel.org/stable/c/26b5934ff4194e13196bedcba373cd4915071d0e
https://git.kernel.org/stable/c/4ab6f96444e936f5e4a936d5c0bc948144bcded3
https://git.kernel.org/stable/c/6044791b7be707fd0e709f26e961a446424e5051
https://git.kernel.org/stable/c/74fd5839467054cd9c4d050614d3ee8788386171
https://git.kernel.org/stable/c/b2d7a92aff0fbd93c29d2aa6451fb99f050e2c4e