Lucene search

K
vulnrichmentCanonicalVULNRICHMENT:CVE-2022-2585
HistoryJan 08, 2024 - 5:38 p.m.

CVE-2022-2585

2024-01-0817:38:27
CWE-416
canonical
github.com
1
vulnerability
posix cpu timer
use-after-free

CVSS3

5.3

Attack Vector

LOCAL

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H

AI Score

7.1

Confidence

Low

SSVC

Exploitation

none

Automatable

no

Technical Impact

total

It was discovered that when exec’ing from a non-leader thread, armed POSIX CPU timers would be left on a list but freed, leading to a use-after-free.

CVSS3

5.3

Attack Vector

LOCAL

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H

AI Score

7.1

Confidence

Low

SSVC

Exploitation

none

Automatable

no

Technical Impact

total