CVEvulnerability
CVE-2022-0646
7.8 HIGH
Official page ↗
- Status
- Modified
- Published
- 2022-02-18
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 7.8 HIGH — CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- CVSS 2.0 ([email protected])
- 7.2 HIGH — AV:L/AC:L/Au:N/C:C/I:C/A:C
- Weaknesses
- CWE-416, CWE-459
Description
A flaw use after free in the Linux kernel Management Component Transport Protocol (MCTP) subsystem was found in the way user triggers cancel_work_sync after the unregister_netdev during removing device. A local user could use this flaw to crash the system or escalate their privileges on the system. It is actual from Linux Kernel 5.17-rc1 (when mctp-serial.c introduced) till 5.17-rc5.
Affected configurations
• linux linux kernel 5.17
• netapp h410c firmware
• netapp h300s firmware
• netapp h500s firmware
• netapp h700s firmware
• netapp h300e firmware
• netapp h500e firmware
• netapp h700e firmware
• netapp h410s firmware
Related
References
- https://lore.kernel.org/all/20220211011552.1861886-1-jk%40codeconstruct.com.au Mailing List, Patch
- https://security.netapp.com/advisory/ntap-20220318-0006/ Third Party Advisory
- https://lore.kernel.org/all/20220211011552.1861886-1-jk%40codeconstruct.com.au Mailing List, Patch
- https://security.netapp.com/advisory/ntap-20220318-0006/ Third Party Advisory