CVE-2022-1204: Use After Free
A use-after-free flaw was found in the Linux kernel’s Amateur Radio AX.25 protocol functionality in the way a user connects with the protocol. This flaw allows a local user to crash the system.
Other sources
There are use-after-free vulnerabilities in net/ax25/afax25.c of linux that allow attacker to crash linux kernel by simulating Amateur Radio from user-space.
Upstream fix:
https://github.com/torvalds/linux/commit/d01ffb9eee4af165d83b08dd73ebdf9fe94a519b https://github.com/torvalds/linux/commit/87563a043cef044fed5db7967a75741cc16ad2b1 https://github.com/torvalds/linux/commit/feef318c855a361a1eccd880f33e88c460eb63b4 https://github.com/torvalds/linux/commit/9fd75b66b8f68498454d685dc4ba13192ae069b0 https://github.com/torvalds/linux/commit/5352a761308397a0e6250fdc629bb3f615b94747
— Red Hat
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2022-1204?
CVE-2022-1204 has a moderate severity rating due to its potential to allow local users to crash the system.
How do I fix CVE-2022-1204?
To fix CVE-2022-1204, update the Linux kernel to versions 5.10.223-1, 5.10.226-1, 6.1.123-1, 6.1.119-1, 6.12.11-1, or 6.12.12-1.
What systems are affected by CVE-2022-1204?
CVE-2022-1204 affects various versions of the Linux kernel including versions up to 5.17 as well as specific builds of Fedora and Debian.
What is the nature of the vulnerability in CVE-2022-1204?
CVE-2022-1204 is a use-after-free vulnerability occurring in the Amateur Radio AX.25 protocol functionality of the Linux kernel.
Can CVE-2022-1204 be exploited remotely?
CVE-2022-1204 is not considered a remote vulnerability as it can only be exploited by a local user on the affected systems.