NexaPulse
Subscribe
7.0highHigh

CVE-2022-29582

Linux Linux Kernel

In the Linux kernel before 5.17.3, fs/io_uring.c has a use-after-free due to a race condition in io_uring timeouts. This can be triggered by a local user who has no access to any user namespace; however, the race condition perhaps can only be exploited infrequently.

Exploitation status

  • Published references include exploit or proof-of-concept material. There is no confirmation it is being used in real attacks.
  • A vendor advisory or patch reference has been published.

What the metrics mean

  • It is requires local access to the machine.
  • For an attacker who can reach it, exploitation depends on conditions outside the attacker's control.
  • To exploit it, an ordinary user account is needed.
  • Beyond that, no action by a user is required.

Scoring

CVSS
7.0 (v3.1)
Vector
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-362
Assigned by
cve@mitre.org

Dates

Published
2022-04-22
Last modified
2026-08-13
Sources
NVD

Affected products

  • Linux Linux Kernel- 5.10.111, 5.11 - 5.15.34, 5.16 - 5.16.20, 5.17 - 5.17.3
  • Debian Debian Linux11.0

As listed in the NVD configuration data. Not a statement about your estate.

References