NetSight
IP …
high7.8

CVE-2022-34918

An issue was discovered in the Linux kernel through 5.18.9.

Impact

An issue was discovered in the Linux kernel through 5.18.9. A type confusion bug in nft_set_elem_init (leading to a buffer overflow) could be used by a local attacker to escalate privileges, a different vulnerability than CVE-2022-32250. (The attacker can obtain root access, but must start with an unprivileged user namespace to obtain CAP_NET_ADMIN access.) This can be fixed in nft_setelem_parse_data in net/netfilter/nf_tables_api.c.

Affected products

VendorProductAffected versions
LinuxLinux Kernel
from 4.1 before 4.14.316
from 4.15 before 4.19.284
from 4.20 before 5.4.244
from 5.5 before 5.10.130
from 5.11 before 5.15.54
from 5.16 before 5.18.11
DebianDebian Linux
Version 11.0
CanonicalUbuntu Linux
Versions 14.04, 16.04, 18.04, 20.04, 22.04
NetappH300s Firmware
All versions
NetappH500s Firmware
All versions
NetappH700s Firmware
All versions
NetappH410s Firmware
All versions
NetappH410c Firmware
All versions

Weakness classification

CWE-843

References