CVE-2022-3028: debian debian_linux Improper Locking

Vulnerability summary

CVE-2022-3028 is a high (CVSS 7.0) Improper Locking vulnerability in debian debian_linux. EPSS estimates a 0.23% chance of exploitation in the next 30 days, higher than 13.6% of scored vulnerabilities.

Timeline

1. 31-08-2022
   PublishedVulnerability first disclosed.
2. 14-10-2026
   Last modifiedVulnerability information updated.

Description

A race condition was found in the Linux kernel's IP framework for transforming packets (XFRM subsystem) when multiple calls to xfrm_probe_algs occurred simultaneously. This flaw could allow a local attacker to potentially trigger an out-of-bounds write or leak kernel heap memory by performing an out-of-bounds read and copying it into a socket.

• CWE-667Improper LockingThe product does not properly acquire or release a lock on a resource, leading to unexpected resource state changes and behaviors.
• CWE-362Concurrent Execution using Shared Resource with Improper SynchronizationThe product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently.
• CWE-787Out-of-bounds WriteThe product writes data past the end, or before the beginning, of the intended buffer.