CVE-2022-3543: Linux Kernel BPF af_unix.c unix_release_sock memory leak
Vulnerability summary
CVE-2022-3543 is a medium (CVSS 5.5) Improper Resource Shutdown or Release vulnerability in linux kernel. EPSS estimates a 0.28% chance of exploitation in the next 30 days, higher than 20.4% of scored vulnerabilities.
Not severe (CVSS 3.5, adjacent network); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 6 · Related 4Timeline
- 17-10-2022PublishedVulnerability first disclosed.
- 03-08-2024Last modifiedVulnerability information updated.
Description
A vulnerability, which was classified as problematic, has been found in Linux Kernel. This issue affects the function unix_sock_destructor/unix_release_sock of the file net/unix/af_unix.c of the component BPF. The manipulation leads to memory leak. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-211043.
CVSS metrics
4 scores · 4 sources · 1 version- CVE.orgCNA3.5LowCVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:LDiffers
- OSV · UbuntuEcosystem advisory · calculated3.5LowCVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:LDiffers
- OSV · DebianEcosystem advisory · calculated5.5MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
EPSS trend
Probability
0.28%
Chance of exploitation in the next 30 days
Percentile
20%
Versus all other CVEs
30-day change
Increase +0.01 pp
From 0.27% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-404Improper Resource Shutdown or ReleaseThe product does not release or incorrectly releases a resource before it is made available for re-use.
- CWE-401Missing Release of Memory after Effective LifetimeThe product does not sufficiently track and release allocated memory after it has been used, making the memory unavailable for reallocation and reuse.
Affected systems
Known conditions: adjacent network, low-privilege account, no user interaction (CVSS vector). Other conditions: not stated in public data.
Ubuntu72 products
- linux< 5.15.0-60.66
- linux-aws< 5.15.0-1030.34
- linux-aws-5.0All versions (No fix recorded)
- linux-aws-5.11All versions (No fix recorded)
- linux-aws-5.13All versions (No fix recorded)
Linux2 products
- kerneln/a
- linux_kernel< 6.1
Debian1 product
- linux< 6.0.3-1
3 vendors · 75 products
References
15 links- vuldb.com?id.211043Permissions Required
