CVE-2022-0435: fedoraproject fedora Out-of-bounds Write
Vulnerability summary
CVE-2022-0435 is a high (CVSS 9.0) Out-of-bounds Write vulnerability in fedoraproject fedora. EPSS estimates a 67.77% chance of exploitation in the next 30 days, higher than 99.3% of scored vulnerabilities. 1 public exploit is recorded.
Public exploit (reference, Date unknown)
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 39 · Related 24Timeline
- 25-03-2022PublishedVulnerability first disclosed.
- 02-08-2024Last modifiedVulnerability information updated.
Description
A stack overflow flaw was found in the Linux kernel's TIPC protocol functionality in the way a user sends a packet with malicious content where the number of domain member nodes is higher than the 64 allowed. This flaw allows a remote user to crash the system or possibly escalate their privileges if they have access to the TIPC network.
CVSS metrics
6 scores · 4 sources · 3 versions- OSV · UbuntuEcosystem advisory · calculated8.8HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HDiffers
- OSV · DebianEcosystem advisory · calculated8.8HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HDiffers
- NVDNIST8.8HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HDiffers
EPSS trend
Probability
67.77%
Chance of exploitation in the next 30 days
Percentile
99%
Versus all other CVEs
30-day change
Decrease -0.22 pp
From 67.99% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
1 foundExploit Reference (openwall.com)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Known conditions: network-reachable, low-privilege account, no user interaction (CVSS vector). Other conditions: not stated in public data.
Redhat105 products
- codeready_linux_builder8.0 | 8.4
- codeready_linux_builder_eus8.2
- codeready_linux_builder_eus_for_power_little_endian8.2
- codeready_linux_builder_for_power_little_endian_eus8.0 | 8.4
- enterprise_linux8.0
Ubuntu68 products
- linux< 4.15.0-173.182 | < 5.4.0-105.119
- linux-aws< 4.15.0-1124.133 | < 5.4.0-1069.73
- linux-aws-5.0All versions (No fix recorded)
- linux-aws-5.11All versions (No fix recorded)
- linux-aws-5.13< 5.13.0-1019.21~20.04.1
Suse3 products
- kernel-livepatch-SLE15-SP2_Update_23&distro=SUSE Linux Enterprise Live Patching 15 SP2< 2-2.2
- kernel-livepatch-SLE15-SP3_Update_12&distro=SUSE Linux Enterprise Live Patching 15 SP3< 2-150300.2.2
- kernel-livepatch-SLE15-SP3_Update_13&distro=SUSE Linux Enterprise Live Patching 15 SP3< 2-150300.2.2
Debian1 product
- linux< 5.16.10-1
Fedoraproject1 product
- fedoraEOL34 | 35
Linux1 product
- linux_kernelEOL≥ 4.8, < 4.9.301 | ≥ 4.10, < 4.14.266 | ≥ 4.15, < 4.19.229 | ≥ 4.20, < 5.4.179 | ≥ 5.5, < 5.10.100 | ≥ 5.11, < 5.15.23 | ≥ 5.16, < 5.16.9 | 5.17 | 5.17:rc1 | 5.17:rc2 | 5.17:rc3
Ovirt1 product
- node4.4.10
8 vendors · 187 products
References
25 links- www.openwall.com/lists/oss-security/2022/02/10/1ARTICLEREPORTExploitMailing ListMitigationPatchThird Party Advisory
- security.netapp.com/advisory/ntap-20220602-0001/Third Party Advisory
