CVE-2022-1011

A use-after-free flaw was found in the Linux kernel’s FUSE filesystem in the way a user triggers write(). This flaw allows a local user to gain unauthorized access to data from the FUSE filesystem, resulting in privilege escalation.

Score

CVSS 3.1 7.8 High

Status

Analyzed - secalert@redhat.com

Published

2022-03-18

Last modified

2024-08-02

Weaknesses

CWE-416

Affected products

• Debian Linux (Debian)
• Fedora (Fedoraproject)
• Linux Kernel (Linux)
• H300e Firmware (Netapp)
• H300s Firmware (Netapp)
• H410c Firmware (Netapp)
• H410s Firmware (Netapp)
• H500e Firmware (Netapp)
• H500s Firmware (Netapp)
• H700e Firmware (Netapp)
• H700s Firmware (Netapp)
• Communications Cloud Native Core Binding Support Function (Oracle)
• Build Of Quarkus (Redhat)
• Codeready Linux Builder (Redhat)
• Developer Tools (Redhat)
• Enterprise Linux (Redhat)
• Enterprise Linux Eus (Redhat)
• Enterprise Linux For Ibm Z Systems (Redhat)
• Enterprise Linux For Ibm Z Systems Eus (Redhat)
• Enterprise Linux For Power Little Endian (Redhat)
• Enterprise Linux For Power Little Endian Eus (Redhat)
• Enterprise Linux For Real Time (Redhat)
• Enterprise Linux For Real Time For Nfv (Redhat)
• Enterprise Linux For Real Time For Nfv Tus (Redhat)
• Enterprise Linux For Real Time Tus (Redhat)
• Enterprise Linux Server Aus (Redhat)
• Enterprise Linux Server For Power Little Endian Update Services For Sap Solutions (Redhat)
• Enterprise Linux Server Tus (Redhat)
• Enterprise Linux Server Update Services For Sap Solutions (Redhat)
• Virtualization Host (Redhat)

References

• https://bugzilla.redhat.com/show_bug.cgi?id=2064855
• https://git.kernel.org/pub/scm/linux/kernel/git/mszeredi/fuse.git/commit/?h=for-next
• https://lists.debian.org/debian-lts-announce/2022/07/msg00000.html
• https://www.debian.org/security/2022/dsa-5173
• https://www.oracle.com/security-alerts/cpujul2022.html