CVE-2022-1015: fedoraproject fedora Out-of-bounds Write
Vulnerability summary
CVE-2022-1015 is a medium (CVSS 6.6) Out-of-bounds Write vulnerability in fedoraproject fedora. EPSS estimates a 1.49% chance of exploitation in the next 30 days, higher than 74.1% of scored vulnerabilities. 3 public exploits are recorded.
Not severe (CVSS 6.6, local access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 7 · Related 4Timeline
- 29-04-2022PublishedVulnerability first disclosed.
- 14-10-2026Last modifiedVulnerability information updated.
Description
A flaw was found in the Linux kernel in linux/net/netfilter/nf_tables_api.c of the netfilter subsystem. This flaw allows a local user to cause an out-of-bounds write issue.
CVSS metrics
4 scores · 3 sources · 2 versions- OSV · UbuntuEcosystem advisory · calculated6.6MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H
- OSV · DebianEcosystem advisory · calculated6.6MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H
EPSS trend
Probability
1.49%
Chance of exploitation in the next 30 days
Percentile
74%
Versus all other CVEs
30-day change
Increase +0.03 pp
From 1.47% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
3 foundExploit Reference (bugzilla.redhat.com)
Maturity: unknown
Exploit Reference (blog.dbouman.nl)
Maturity: unknown
Exploit Reference (seclists.org)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Known conditions: local access, low-privilege account, no user interaction (CVSS vector). Other conditions: not stated in public data.
Ubuntu51 products
- linux< 5.15.0-27.28
- linux-aws< 5.15.0-1005.7
- linux-aws-5.0All versions (No fix recorded)
- linux-aws-5.11All versions (No fix recorded)
- linux-aws-5.13< 5.13.0-1022.24~20.04.1
Debian1 product
- linux< 5.16.18-1
Fedoraproject1 product
- fedoraEOL35
Linux1 product
- linux_kernel< 5.16.18
4 vendors · 54 products
References
20 links- blog.dbouman.nl/2022/04/02/How-The-Tables-Have-Turned-CVE-2022-1015-1016/ExploitThird Party Advisory
- packetstormsecurity.com/files/169951/Kernel-Live-Patch-Security-Notice-LSN-0090-1.htmlThird Party AdvisoryVDB Entry
- www.openwall.com/lists/oss-security/2023/02/23/1Mailing List
