CVE-2022-32091: debian debian_linux Use After Free

CVSS: 7.5v3.1HighModified

AliasesALPINE-CVE-2022-32091UBUNTU-CVE-2022-32091DEBIAN-CVE-2022-32091

Published 01-07-2022Last modified 03-08-2024

Vulnerability summary

CVE-2022-32091 is a high (CVSS 7.5) Use After Free vulnerability in debian debian_linux. EPSS estimates a 2.37% chance of exploitation in the next 30 days, higher than 83.5% of scored vulnerabilities. 1 public exploit is recorded.

Overall risk

40/100

0100

Medium · default modelHow is this calculated?

CVSS score

7.5/10

010

High · v3.1 (NVD)

EPSS score

2.37%

0%100%

Low · 0.00 pp in 30 days

KEVNot listedIn no KEV catalog

RansomwareNone recordedNo known use recorded

Public exploits1reference

Advisory lineage

Upstream 0 · Downstream 16 · Related 7

DLA-3114-1 MGASA-2022-0314 OPENSUSE-SU-2024:12360-1 RHSA-2023:5259 RHSA-2023:5683 RHSA-2023:5684+10 more

Timeline

01-07-2022
PublishedVulnerability first disclosed.
03-08-2024
Last modifiedVulnerability information updated.

Description

MariaDB v10.7 was discovered to contain an use-after-poison in in __interceptor_memset at /libsanitizer/sanitizer_common/sanitizer_common_interceptors.inc.

CVSS metrics

5 scores · 4 sources · 2 versions

v3.17.5v2.05.0

EPSS trend

Probability

2.37%

Chance of exploitation in the next 30 days

Percentile

84%

Versus all other CVEs

30-day change

0.00 pp

From 2.37% on 19-09-2026

19-09-202619-10-2026

EPSS score

2.37%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

1 found

referenceUnverified
Exploit Reference (jira.mariadb.org)
Maturity: unknown

Weaknesses

CWE · root cause

CWE-416Use After FreeThe product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

Affected systems

Ubuntu4 products

mariadb-10.0All versions (No fix recorded)
mariadb-10.1All versions (No fix recorded)
mariadb-10.3< 1:10.3.37-0ubuntu0.20.04.1
mariadb-10.6< 1:10.6.11-0ubuntu0.22.04.1

Debian2 products

mariadb-10.5< 1:10.5.18-0+deb11u1
debian_linuxEOL10.0

Alpine1 product

mariadb≥ 10.3.0, < 10.5.17-r0 | ≥ 10.3.0, < 10.6.9-r0

Fedoraproject1 product

fedoraEOL35 | 36 | 37

Mariadb1 product

mariadb≥ 10.3.0, < 10.3.36 | ≥ 10.4.0, < 10.4.26 | ≥ 10.5.0, < 10.5.17 | ≥ 10.6.0, < 10.6.9 | ≥ 10.7.0, < 10.7.5 | ≥ 10.8.0, < 10.8.4 | ≥ 10.9.0, < 10.9.2

5 vendors · 9 products