CVEvulnerability

CVE-2022-21505

6.7 MEDIUM Published 2024-12-24 Modified 2026-10-14 Official page ↗
Status
Modified
Published
2024-12-24
Last modified
2026-10-14
Assigner
[email protected]
CVSS 3.1 ([email protected])
6.7 MEDIUM — CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-346

Description

In the linux kernel, if IMA appraisal is used with the "ima_appraise=log" boot param, lockdown can be defeated with kexec on any machine when Secure Boot is disabled or unavailable. IMA prevents setting "ima_appraise=log" from the boot param when Secure Boot is enabled, but this does not cover cases where lockdown is used without Secure Boot. CVSS 3.1 Base Score 6.7 (Confidentiality, Integrity, Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).

Affected configurations

• oracle linux 7 • oracle linux 8 • oracle linux 9

Related

Weakness · CWE (1)

  • CWE-346 Origin Validation Error weakness

References