CVE-2022-3646

Description

A vulnerability, which was classified as problematic, has been found in Linux Kernel. This issue affects the function nilfs_attach_log_writer of the file fs/nilfs2/segment.c of the component BPF. The manipulation leads to memory leak. The attack may be initiated remotely. It is recommended to apply a patch to fix this issue. The identifier VDB-211961 was assigned to this vulnerability.

CVSS Metrics

• v3.1•LOW•Score: 3.1CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L
• v3.1•MEDIUM•Score: 4.3CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

EPSS Trends

Current EPSS score: 0.12%• Percentile: 31%

Techniques & Countermeasures

• CWE-404•Improper Resource Shutdown or Release

  The product does not release or incorrectly releases a resource before it is made available for re-use.

• CWE-401•Missing Release of Memory after Effective Lifetime

  The product does not sufficiently track and release allocated memory after it has been used, making the memory unavailable for reallocation and reuse.

Affected Systems

• debian•debian_linux

  10.0

• Unknown•Kernel

  n/a

• linux•linux_kernel

  na

References (4)

• https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next.git/commit/?id=d0d51a97063db4704a5ef6bc978dddab1636a306
• https://vuldb.com/?id.211961
• https://lists.debian.org/debian-lts-announce/2022/11/msg00001.html
• https://lists.debian.org/debian-lts-announce/2022/12/msg00034.html