Lucene search

K
ubuntucveUbuntu.comUB:CVE-2022-2503
HistoryAug 12, 2022 - 12:00 a.m.

CVE-2022-2503

2022-08-1200:00:00
ubuntu.com
ubuntu.com
22

6.7 Medium

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

4 Medium

CVSS2

Access Vector

LOCAL

Access Complexity

LOW

Authentication

MULTIPLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:L/AC:L/Au:M/C:P/I:P/A:P

0.0005 Low

EPSS

Percentile

15.4%

Dm-verity is used for extending root-of-trust to root filesystems. LoadPin
builds on this property to restrict module/firmware loads to just the
trusted root filesystem. Device-mapper table reloads currently allow users
with root privileges to switch out the target with an equivalent dm-linear
target and bypass verification till reboot. This allows root to bypass
LoadPin and can be used to load untrusted and unverified kernel modules and
firmware, which implies arbitrary kernel execution and persistence for
peripherals that do not verify firmware updates. We recommend upgrading
past commit 4caae58406f8ceb741603eee460d79bacca9b1b5

OSVersionArchitecturePackageVersionFilename
ubuntu22.04noarchlinux-nvidia< 5.15.0-1007.7UNKNOWN
ubuntu18.04noarchlinux< 4.15.0-191.202UNKNOWN
ubuntu20.04noarchlinux< 5.4.0-126.142UNKNOWN
ubuntu22.04noarchlinux< 5.15.0-47.51UNKNOWN
ubuntu16.04noarchlinux< 4.4.0-239.273) Available with Ubuntu Pro or Ubuntu Pro (Infra-onlyUNKNOWN
ubuntu18.04noarchlinux-aws< 4.15.0-1139.150UNKNOWN
ubuntu20.04noarchlinux-aws< 5.4.0-1085.92UNKNOWN
ubuntu22.04noarchlinux-aws< 5.15.0-1019.23UNKNOWN
ubuntu16.04noarchlinux-aws< 4.4.0-1155.170) Available with Ubuntu Pro or Ubuntu Pro (Infra-onlyUNKNOWN
ubuntu14.04noarchlinux-aws< 4.4.0-1117.123) Available with Ubuntu Pro or Ubuntu Pro (Infra-onlyUNKNOWN
Rows per page:
1-10 of 671

6.7 Medium

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

4 Medium

CVSS2

Access Vector

LOCAL

Access Complexity

LOW

Authentication

MULTIPLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:L/AC:L/Au:M/C:P/I:P/A:P

0.0005 Low

EPSS

Percentile

15.4%

Related for UB:CVE-2022-2503