CVE-2022-4744

Advisory lineage Upstream: 0 Downstream: 37
Modified
Published: 30 Mar 2023, 00:00
Last modified:14 Feb 2025, 15:45

Vulnerability Summary

Overall Risk (default)
medium
31/100
CVSS Score
7.8 HIGH
v3.1 (cve.org)
EPSS Score
0.1% LOW
0% probability +0.01%
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

30 Mar 2023, 00:00
Published
Vulnerability first disclosed
14 Feb 2025, 15:45
Last Modified
Vulnerability information updated

Description

A double-free flaw was found in the Linux kernel’s TUN/TAP device driver functionality in how a user registers the device when the register_netdevice function fails (NETDEV_REGISTER notifier). This flaw allows a local user to crash or potentially escalate their privileges on the system.

CVSS Metrics

  • v3.1•HIGH•Score: 7.8CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS Trends

Current EPSS score: 0.10%• Percentile: 27%

Techniques & Countermeasures

  • CWE-460•Improper Cleanup on Thrown Exception

    The product does not clean up its state or incorrectly cleans up its state when an exception is thrown, leading to unexpected state or control flow.

  • CWE-415•Double Free

    The product calls free() twice on the same memory address.

Affected Systems

  • linux•linux_kernel

    ≥ 5.5, < 5.10.136 | ≥ 5.11, < 5.15.12

References (4)