CVE-2022-3543

Description

A vulnerability, which was classified as problematic, has been found in Linux Kernel. This issue affects the function unix_sock_destructor/unix_release_sock of the file net/unix/af_unix.c of the component BPF. The manipulation leads to memory leak. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-211043.

CVSS Metrics

• v3.1•LOW•Score: 3.5CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
• v3.1•MEDIUM•Score: 5.5CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

EPSS Trends

Current EPSS score: 0.27%• Percentile: 19%

Techniques & Countermeasures

• CWE-404•Improper Resource Shutdown or Release

  The product does not release or incorrectly releases a resource before it is made available for re-use.

• CWE-401•Missing Release of Memory after Effective Lifetime

  The product does not sufficiently track and release allocated memory after it has been used, making the memory unavailable for reallocation and reuse.

Affected Systems

• debian•linux

  < 6.0.3-1 | < 6.0.3-1 | < 6.0.3-1

• linux•kernel

  n/a

• linux•linux_kernel

  < 6.1

References (3)

• https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next.git/commit/?id=7a62ed61367b8fd01bae1e18e30602c25060d824
• https://vuldb.com/?id.211043
• https://security-tracker.debian.org/tracker/CVE-2022-3543