A use-after-free flaw was found in the Linux kernel’s FUSE filesystem in the way a user triggers write(). This flaw allows a local user to gain unauthorized access to data from the FUSE filesystem, resulting in privilege escalation.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

Access Vector Local

Access Complexity Low

Authentication None

Confidentiality Impact Partial

Integrity Impact Partial

Availability Impact Partial

This CVE is not in the KEV list.

The EPSS score is 0.00201.

Key SSVC decision points have not yet been added.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions
n/a kernel affected
Version Status Constraints
Linux kernel 5.16-rc8 affected —

Configuration 1 [-]

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.17:-:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.17:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.17:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.17:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.17:rc4:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.17:rc7:*:*:*:*:*:*

Configuration 2 [-]

OR cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*

Configuration 3 [-]

OR cpe:2.3:a:redhat:build_of_quarkus:2.0:*:*:*:*:*:*:*
cpe:2.3:a:redhat:developer_tools:1.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_eus:8.6:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems:8.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems_eus:8.6:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian:8.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_eus:8.6:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_for_real_time:8:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_for_real_time_for_nfv:8:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_for_real_time_for_nfv_tus:8.6:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_for_real_time_tus:8.6:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server_aus:8.6:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions:8.6:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server_tus:8.6:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server_update_services_for_sap_solutions:8.6:*:*:*:*:*:*:*

Configuration 4 [-]

AND
cpe:2.3:a:redhat:virtualization_host:4.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*

Configuration 5 [-]

AND
cpe:2.3:a:redhat:codeready_linux_builder:-:*:*:*:*:*:*:*
OR cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:8.6:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_eus:8.6:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian:8.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_eus:8.6:*:*:*:*:*:*:*

Configuration 6 [-]

AND
cpe:2.3:o:netapp:h300s_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:netapp:h300s:-:*:*:*:*:*:*:*

Configuration 7 [-]

AND
cpe:2.3:o:netapp:h500s_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:netapp:h500s:-:*:*:*:*:*:*:*

Configuration 8 [-]

AND
cpe:2.3:o:netapp:h700s_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:netapp:h700s:-:*:*:*:*:*:*:*

Configuration 9 [-]

AND
cpe:2.3:o:netapp:h300e_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:netapp:h300e:-:*:*:*:*:*:*:*

Configuration 10 [-]

AND
cpe:2.3:o:netapp:h500e_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:netapp:h500e:-:*:*:*:*:*:*:*

Configuration 11 [-]

AND
cpe:2.3:o:netapp:h700e_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:netapp:h700e:-:*:*:*:*:*:*:*

Configuration 12 [-]

AND
cpe:2.3:o:netapp:h410s_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:netapp:h410s:-:*:*:*:*:*:*:*

Configuration 13 [-]

AND
cpe:2.3:o:netapp:h410c_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:netapp:h410c:-:*:*:*:*:*:*:*

Configuration 14 [-]

OR cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*

Configuration 15 [-]

cpe:2.3:a:oracle:communications_cloud_native_core_binding_support_function:22.1.3:*:*:*:*:*:*:*
Package CPE Advisory Released Date
Red Hat Enterprise Linux 7 Extended Lifecycle Support
kernel-0:3.10.0-1160.123.1.el7 cpe:/o:redhat:rhel_els:7 RHSA-2024:5259 2024-08-13T00:00:00Z
Red Hat Enterprise Linux 8
kernel-rt-0:4.18.0-372.9.1.rt7.166.el8 cpe:/a:redhat:enterprise_linux:8::nfv RHSA-2022:1975 2022-05-10T00:00:00Z
kernel-0:4.18.0-372.9.1.el8 cpe:/o:redhat:enterprise_linux:8 RHSA-2022:1988 2022-05-10T00:00:00Z

No data.

Project Subscriptions

Vendors Products
Debian Subscribe
Debian Linux Subscribe
Fedoraproject Subscribe
Fedora Subscribe
Linux Subscribe
Linux Kernel Subscribe
Netapp Subscribe
H300e Subscribe
H300e Firmware Subscribe
H300s Subscribe
H300s Firmware Subscribe
H410c Subscribe
H410c Firmware Subscribe
H410s Subscribe
H410s Firmware Subscribe
H500e Subscribe
H500e Firmware Subscribe
H500s Subscribe
H500s Firmware Subscribe
H700e Subscribe
H700e Firmware Subscribe
H700s Subscribe
H700s Firmware Subscribe
Oracle Subscribe
Communications Cloud Native Core Binding Support Function Subscribe
Redhat Subscribe
Build Of Quarkus Subscribe
Codeready Linux Builder Subscribe
Developer Tools Subscribe
Enterprise Linux Subscribe
Enterprise Linux Eus Subscribe
Enterprise Linux For Ibm Z Systems Subscribe
Enterprise Linux For Ibm Z Systems Eus Subscribe
Enterprise Linux For Power Little Endian Subscribe
Enterprise Linux For Power Little Endian Eus Subscribe
Enterprise Linux For Real Time Subscribe
Enterprise Linux For Real Time For Nfv Subscribe
Enterprise Linux For Real Time For Nfv Tus Subscribe
Enterprise Linux For Real Time Tus Subscribe
Enterprise Linux Server Aus Subscribe
Enterprise Linux Server For Power Little Endian Update Services For Sap Solutions Subscribe
Enterprise Linux Server Tus Subscribe
Enterprise Linux Server Update Services For Sap Solutions Subscribe
Rhel Els Subscribe
Virtualization Host Subscribe
Advisories
Source ID Title
Debian DLA Debian DLA DLA-3065-1 linux security update
Debian DSA Debian DSA DSA-5173-1 linux security update
EUVD EUVD EUVD-2022-24361 A use-after-free flaw was found in the Linux kernel’s FUSE filesystem in the way a user triggers write(). This flaw allows a local user to gain unauthorized access to data from the FUSE filesystem, resulting in privilege escalation.
Ubuntu USN Ubuntu USN USN-5381-1 Linux kernel (OEM) vulnerabilities
Ubuntu USN Ubuntu USN USN-5467-1 Linux kernel vulnerabilities
Ubuntu USN Ubuntu USN USN-5515-1 Linux kernel vulnerabilities
Ubuntu USN Ubuntu USN USN-5541-1 Linux kernel (Azure) vulnerabilities
Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
https://bugzilla.redhat.com/show_bug.cgi?id=2064855 cve-icon cve-icon
https://git.kernel.org/pub/scm/linux/kernel/git/mszeredi/fuse.git/commit/?h=for-next cve-icon cve-icon
https://lists.debian.org/debian-lts-announce/2022/07/msg00000.html cve-icon cve-icon
https://lore.kernel.org/lkml/20220414110839.241541230@linuxfoundation.org/ cve-icon
https://nvd.nist.gov/vuln/detail/CVE-2022-1011 cve-icon
https://www.cve.org/CVERecord?id=CVE-2022-1011 cve-icon
https://www.debian.org/security/2022/dsa-5173 cve-icon cve-icon
https://www.oracle.com/security-alerts/cpujul2022.html cve-icon cve-icon
History

Tue, 13 Aug 2024 22:30:00 +0000

Type Values Removed Values Added
First Time appeared Redhat rhel Els
CPEs cpe:/o:redhat:rhel_els:7
Vendors & Products Redhat rhel Els

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: redhat

Published:

Updated: 2024-08-02T23:47:43.229Z

Reserved: 2022-03-17T00:00:00

Link: CVE-2022-1011

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Modified

Published: 2022-03-18T18:15:12.177

Modified: 2024-11-21T06:39:51.280

Link: CVE-2022-1011

cve-icon Redhat

Severity : Moderate

Publid Date: 2022-03-07T10:00:00Z

Links: CVE-2022-1011 - Bugzilla

cve-icon OpenCVE Enrichment

No data.

Weaknesses