high7.8
CVE-2022-1011
A use-after-free flaw was found in the Linux kernel’s FUSE filesystem in the way a user triggers write().
Impact
A use-after-free flaw was found in the Linux kernel’s FUSE filesystem in the way a user triggers write(). This flaw allows a local user to gain unauthorized access to data from the FUSE filesystem, resulting in privilege escalation.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Linux | Linux Kernel | from 2.6.35 before 4.9.320 from 4.10 before 4.14.276 from 4.15 before 4.19.238 from 4.20 before 5.4.185 from 5.5 before 5.10.106 from 5.11 before 5.15.29 |
| Fedoraproject | Fedora | Versions 34, 35 |
| Redhat | Build Of Quarkus | Version 2.0 |
| Redhat | Developer Tools | Version 1.0 |
| Redhat | Enterprise Linux | Versions 6.0, 7.0, 8.0 |
| Redhat | Enterprise Linux Eus | Version 8.6 |
| Redhat | Enterprise Linux For Ibm Z Systems | Version 8.0 |
| Redhat | Enterprise Linux For Ibm Z Systems Eus | Version 8.6 |
| Redhat | Enterprise Linux For Power Little Endian | Version 8.0 |
| Redhat | Enterprise Linux For Power Little Endian Eus | Version 8.6 |
| Redhat | Enterprise Linux For Real Time | Version 8 |
| Redhat | Enterprise Linux For Real Time For Nfv | Version 8 |
Weakness classification
References
- NVD record
- CVE.org record
- https://bugzilla.redhat.com/show_bug.cgi?id=2064855
- https://git.kernel.org/pub/scm/linux/kernel/git/mszeredi/fuse.git/commit/?h=for-next
- https://lists.debian.org/debian-lts-announce/2022/07/msg00000.html
- https://www.debian.org/security/2022/dsa-5173
- https://www.oracle.com/security-alerts/cpujul2022.html
- https://bugzilla.redhat.com/show_bug.cgi?id=2064855
- https://git.kernel.org/pub/scm/linux/kernel/git/mszeredi/fuse.git/commit/?h=for-next
- https://lists.debian.org/debian-lts-announce/2022/07/msg00000.html
- https://www.debian.org/security/2022/dsa-5173
- https://www.oracle.com/security-alerts/cpujul2022.html