7.8
CVSSv3

CVE-2022-23222

Published: 14/01/2022 Updated: 25/03/2024
CVSS v2 Base Score: 7.2 | Impact Score: 10 | Exploitability Score: 3.9
CVSS v3 Base Score: 7.8 | Impact Score: 5.9 | Exploitability Score: 1.8
VMScore: 643
Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C

Vulnerability Summary

kernel/bpf/verifier.c in the Linux kernel up to and including 5.15.14 allows local users to gain privileges because of the availability of pointer arithmetic via certain *_OR_NULL pointer types.

Vulnerability Trend

Vulnerable Product Search on Vulmon Subscribe to Product

linux linux kernel

debian debian linux 11.0

netapp h410c_firmware -

netapp h300s_firmware -

netapp h500s_firmware -

netapp h700s_firmware -

netapp h300e_firmware -

netapp h500e_firmware -

netapp h700e_firmware -

netapp h410s_firmware -

fedoraproject fedora 34

fedoraproject fedora 35

Vendor Advisories

Synopsis Important: kernel security and bug fix update Type/Severity Security Advisory: Important Red Hat Insights patch analysis Identify and remediate systems affected by this advisory View affected systems Topic An update for kernel is now available for Red Hat Enterprise Linux 86 Extended Update SupportRed Hat Product Securit ...
Several vulnerabilities have been discovered in the Linux kernel that may lead to a privilege escalation, denial of service or information leaks CVE-2021-4155 Kirill Tkhai discovered a data leak in the way the XFS_IOC_ALLOCSP IOCTL in the XFS filesystem allowed for a size increase of files with unaligned size A local attacker can tak ...
Several security issues were fixed in the Linux kernel ...
Several security issues were fixed in the Linux kernel ...
Several security issues were fixed in the Linux kernel ...
Several security issues were fixed in the Linux kernel ...
An issue was discovered in fs/io_uringc in the Linux kernel through 5118 It allows attackers to cause a denial of service (deadlock) because exit may be waiting to park a SQPOLL thread, but concurrently that SQPOLL thread is waiting for a signal to start, aka CID-3ebba796fa25 (CVE-2021-28951) A flaw was found in unrestricted eBPF usage by the ...
A flaw was found in unrestricted eBPF usage by the BPF_BTF_LOAD, leading to a possible out-of-bounds memory write in the Linux kernel's BPF subsystem due to the way a user loads BTF This flaw allows a local user to crash or escalate their privileges on the system (CVE-2022-0500) A flaw was found in the Linux kernel in linux/net/netfilter/nf_table ...
kernel/bpf/verifierc in the Linux kernel through 51514 allows local users to gain privileges because of the availability of pointer arithmetic via certain *_OR_NULL pointer types ...
kernel/bpf/verifierc in the Linux Kernel 58 through 51514 allows local users to gain priviledges because of the availability of pointer arithmetic via certain *_OR_NULL pointer types ...
A flaw was found in unrestricted eBPF usage by the BPF_BTF_LOAD, leading to a possible out-of-bounds memory write in the Linux kernel's BPF subsystem due to the way a user loads BTF This flaw allows a local user to crash or escalate their privileges on the system (CVE-2022-0500) A flaw was found in the Linux kernel in linux/net/netfilter/nf_table ...

Mailing Lists

<!--X-Body-Begin--> <!--X-User-Header--> oss-sec mailing list archives <!--X-User-Header-End--> <!--X-TopPNI--> By Date By Thread </form> <!--X-TopPNI-End--> <!--X-MsgBody--> <!--X-Subject-Header-Begin--> Re: Linux Kernel eBPF Improper Input Validation Vulnerability <!--X-Subject-Header-End--> <!--X-Head-of-Message--> From: tr3 ...
<!--X-Body-Begin--> <!--X-User-Header--> oss-sec mailing list archives <!--X-User-Header-End--> <!--X-TopPNI--> By Date By Thread </form> <!--X-TopPNI-End--> <!--X-MsgBody--> <!--X-Subject-Header-Begin--> Re: Linux Kernel eBPF Improper Input Validation Vulnerability <!--X-Subject-Header-End--> <!--X-Head-of-Message--> From: tr3 ...

Github Repositories

CVE-2022-23222: Linux Kernel eBPF Local Privilege Escalation

CVE-2022-23222 Chinese writeup: tr3eee/posts/cve-2022-23222-linux-kernel-ebpf-lpetxt For educational/research purposes only Use at your own risk Build &amp; Run $ make cc -I include -static -w -o exploit exploitc $ /exploit [*] phase(1/8) 'create bpf map(s)' running [+] phase(1/8) 'create bpf map(s)' done [*] phase(2/8) 'do some leak&

BPF Exploit Template Description An eBPF exploitation template inspired by tr3ee's CVE-2022-23222 writeup

CVE-2022-23222, managed with Rust.

CVE-2022-23222 Click here if you just wanna build and run the dang thing What follows is more or less a translation of the Chinese writeup, available here We'll use the mainline kernel code for version 5130 as a reference There is a mismatch in available pointer types and the function that checks their bounds This mismatch was first introduced in Linux 58 and has si

CVE-2022-23222, managed with Rust.

CVE-2022-23222 Click here if you just wanna build and run the dang thing What follows is more or less a translation of the Chinese writeup, available here We'll use the mainline kernel code for version 5130 as a reference There is a mismatch in available pointer types and the function that checks their bounds This mismatch was first introduced in Linux 58 and has si

A collection of Modified EXPs about eBPF.

EXP List CVE-2022-23222 CVE-2021-3490

汽车内核提取漏洞

vehicle-kernel-exploit 汽车内核提取漏洞 0x00支持的漏洞 Nearly all of GTFOBins Writeable dockersock CVE-2022-0847 (Dirty pipe) CVE-2021-4034 (pwnkit) CVE-2021-3560 CVE-2022-23222 0x01Traitor githubcom/liamg/traitor?tab=readme-ov-file#/ 打包了一堆方法来利用本地错误配置和漏洞来提升至root shell: Nearly all of GTFOBins Wr

Proof of Concept Exploit Code for CVE-2022-23222 This is a POC for CVE 2022-23222, a Local Privilege Escalation vulnerability This POC was written for Ubuntu 2004 with kernel version 5130-27-generic, but other kernel versions are also vulnerable For a detailed analysis of the exploit, please read our write-up Usage Make sure libbpf is installed as it is a requirement for