NetSight
IP …
high7.0

CVE-2022-3028

A race condition was found in the Linux kernel's IP framework for transforming packets (XFRM subsystem) when multiple calls to xfrm_probe_algs occurred simulta…

Impact

A race condition was found in the Linux kernel's IP framework for transforming packets (XFRM subsystem) when multiple calls to xfrm_probe_algs occurred simultaneously. This flaw could allow a local attacker to potentially trigger an out-of-bounds write or leak kernel heap memory by performing an out-of-bounds read and copying it into a socket.

Affected products

VendorProductAffected versions
LinuxLinux Kernel
from 3.14 before 4.9.327
from 4.10 before 4.14.292
from 4.15 before 4.19.257
from 4.20 before 5.4.212
from 5.5 before 5.10.140
from 5.11 before 5.15.64
FedoraprojectFedora
Versions 35, 36, 37
DebianDebian Linux
Version 10.0

Weakness classification

CWE-667CWE-362CWE-787

References