CVE-2022-3595

2022-10-1800:00:00

ubuntu.com

linux kernel

cifs handler

vulnerability

double free

patch

vdb-211364

CVSS3

5.5

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

EPSS

Percentile

12.6%

JSON

A vulnerability was found in Linux Kernel. It has been rated as
problematic. Affected by this issue is the function sess_free_buffer of the
file fs/cifs/sess.c of the component CIFS Handler. The manipulation leads
to double free. It is recommended to apply a patch to fix this issue. The
identifier of this vulnerability is VDB-211364.

Notes

Author	Note
rodrigo-zaiden	the vulnerable commit itself (without the fix commit), is not present in any released version, hence all versions are not-affected. in linux-azure kernel for Jammy (5.15), both vulnerable and fix commits are included as a patchset to update CIFS to 6.5 in version 5.15.0-1051.59, so, this kernel is still not-affected as the vulnerable code can not be found without the fix commit in any release.