CVE-2022-28390: Double Free
A double-free flaw was found in the Linux kernel in the emsusbstartxmit function. This flaw allows an attacker to create a memory leak and corrupt the underlying data structure by calling free more than once.
Other sources
emsusbstartxmit in drivers/net/can/usb/emsusb.c in the Linux kernel through 5.17.1 has a double free.
Affected Software
Remediation
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2022-28390?
CVE-2022-28390 has been classified with a medium severity level due to its potential for memory leaks and data corruption.
How do I fix CVE-2022-28390?
To fix CVE-2022-28390, update the Linux kernel to versions 4.18.0-425.3.1.el8, 5.14.0-162.6.1.el9_1, or later versions as specified in the remediation guidelines.
What software versions are affected by CVE-2022-28390?
CVE-2022-28390 affects Linux kernel versions up to and including 5.17.1 across various distributions including Red Hat, Debian, and Fedora.
Can CVE-2022-28390 lead to remote code execution?
CVE-2022-28390 primarily creates a memory leak and data corruption issue, but it does not directly lead to remote code execution.
Is there a public exploit available for CVE-2022-28390?
As of now, there is no known public exploit for CVE-2022-28390, but it is advisable to address the vulnerability promptly.