CVE-2022-4129
A flaw was found in the Linux kernel's Layer 2 Tunneling Protocol (L2TP). A missing lock when clearing sk_user_data can lead to a race condition and NULL pointer dereference. A local user could use this flaw to potentially crash the system causing a denial of service.
- Score
- CVSS 3.1 5.5 Medium
- Status
- Modified - secalert@redhat.com
- Published
- 2022-11-28
- Last modified
- 2026-10-14
- Weaknesses
- CWE-667
Affected products
- Fedora (Fedoraproject)
- Layer 2 Tunneling Protocol (Linux)
- Simatic S7-1500 Tm Mfp - Gnulinux Subsystem (Siemens)
References
- https://lore.kernel.org/all/20221114191619.124659-1-jakub%40cloudflare.com/t
- https://lore.kernel.org/netdev/20221121085426.21315-1-jakub%40cloudflare.com/t
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AM5KFIE6JNZXHBA5A2KYDZ…
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7X5SPXMXXFANDASPCKER2J…
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JOKXNIM2R4FQCDRQV67UMA…
- https://lists.debian.org/debian-lts-announce/2023/05/msg00005.html
- https://cert-portal.siemens.com/productcert/html/ssa-794697.html
