CVE-2022-2964: Buffer Overflow
First published: Mon Mar 21 2022(Updated: )
A flaw was found in the Linux kernel’s driver for the ASIX AX88179_178A-based USB 2.0/3.0 Gigabit Ethernet Devices. The vulnerability contains multiple out-of-bounds reads and possible out-of-bounds writes.
Credit: secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| redhat/kernel-rt | <0:3.10.0-1160.83.1.rt56.1228.el7 | 0:3.10.0-1160.83.1.rt56.1228.el7 |
| redhat/kernel | <0:3.10.0-1160.83.1.el7 | 0:3.10.0-1160.83.1.el7 |
| redhat/kernel-rt | <0:4.18.0-425.10.1.rt7.220.el8_7 | 0:4.18.0-425.10.1.rt7.220.el8_7 |
| redhat/kernel | <0:4.18.0-425.10.1.el8_7 | 0:4.18.0-425.10.1.el8_7 |
| redhat/kernel | <0:4.18.0-147.80.1.el8_1 | 0:4.18.0-147.80.1.el8_1 |
| redhat/kernel | <0:4.18.0-193.98.1.el8_2 | 0:4.18.0-193.98.1.el8_2 |
| redhat/kernel-rt | <0:4.18.0-193.98.1.rt13.149.el8_2 | 0:4.18.0-193.98.1.rt13.149.el8_2 |
| redhat/kernel-rt | <0:4.18.0-305.76.1.rt7.148.el8_4 | 0:4.18.0-305.76.1.rt7.148.el8_4 |
| redhat/kernel | <0:4.18.0-305.76.1.el8_4 | 0:4.18.0-305.76.1.el8_4 |
| redhat/kernel | <0:4.18.0-372.46.1.el8_6 | 0:4.18.0-372.46.1.el8_6 |
| redhat/kernel | <0:5.14.0-162.12.1.el9_1 | 0:5.14.0-162.12.1.el9_1 |
| redhat/kernel-rt | <0:5.14.0-162.12.1.rt21.175.el9_1 | 0:5.14.0-162.12.1.rt21.175.el9_1 |
| redhat/kernel | <0:5.14.0-70.43.1.el9_0 | 0:5.14.0-70.43.1.el9_0 |
| redhat/kernel-rt | <0:5.14.0-70.43.1.rt21.114.el9_0 | 0:5.14.0-70.43.1.rt21.114.el9_0 |
| redhat/kernel | <5.17 | 5.17 |
| Linux Kernel | >=4.20<5.4.180 | |
| Linux Kernel | >=5.5<5.10.101 | |
| Linux Kernel | >=5.11<5.15.24 | |
| Linux Kernel | >=5.16<5.16.10 | |
| Red Hat Enterprise Linux | =7.0 | |
| Red Hat Enterprise Linux | =8.0 | |
| Red Hat Enterprise Linux | =9.0 | |
| All of | ||
| netapp h300s firmware | ||
| netapp h300s | ||
| All of | ||
| NetApp H500S Firmware | ||
| netapp h500s | ||
| All of | ||
| netapp h700s firmware | ||
| netapp h700s | ||
| All of | ||
| netapp h410s firmware | ||
| netapp h410s | ||
| All of | ||
| netapp h410c firmware | ||
| netapp h410c | ||
| netapp h300s firmware | ||
| netapp h300s | ||
| NetApp H500S Firmware | ||
| netapp h500s | ||
| netapp h700s firmware | ||
| netapp h700s | ||
| netapp h410s firmware | ||
| netapp h410s | ||
| netapp h410c firmware | ||
| netapp h410c | ||
| debian/linux | 5.10.223-1 5.10.226-1 6.1.123-1 6.1.128-1 6.12.12-1 6.12.15-1 | |
| IBM Data Virtualization on Cloud Pak for Data | <=3.0 | |
| IBM Watson Query with Cloud Pak for Data as a Service | <=2.2 | |
| IBM Watson Query with Cloud Pak for Data as a Service | <=2.1 | |
| IBM Watson Query with Cloud Pak for Data as a Service | <=2.0 | |
| IBM Data Virtualization on Cloud Pak for Data | <=1.8 | |
| IBM Data Virtualization on Cloud Pak for Data | <=1.7 |
Remedy
Mitigation for this issue is either not available or the currently available options does not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://www.cve.org/CVERecord?id=CVE-2022-2964 https://nvd.nist.gov/vuln/detail/CVE-2022-2964
- https://bugzilla.redhat.com/show_bug.cgi?id=2067482
- https://access.redhat.com/errata/RHSA-2023:0400
- https://access.redhat.com/errata/RHSA-2023:0399
- https://access.redhat.com/errata/RHSA-2023:0404
- https://access.redhat.com/errata/RHSA-2023:0114
- https://access.redhat.com/errata/RHSA-2023:0101
- https://access.redhat.com/errata/RHSA-2023:0123
- https://access.redhat.com/errata/RHSA-2023:0856
- https://access.redhat.com/errata/RHSA-2023:0858
- https://access.redhat.com/errata/RHSA-2023:0395
- https://access.redhat.com/errata/RHSA-2023:0392
- https://access.redhat.com/errata/RHSA-2023:0396
- https://access.redhat.com/errata/RHSA-2023:0531
- https://access.redhat.com/errata/RHSA-2023:0496
- https://access.redhat.com/errata/RHSA-2023:0499
- https://access.redhat.com/errata/RHSA-2023:1130
- https://access.redhat.com/errata/RHSA-2023:1192
- https://access.redhat.com/errata/RHSA-2023:0334
- https://access.redhat.com/errata/RHSA-2023:0300
- https://access.redhat.com/errata/RHSA-2023:0348
- https://access.redhat.com/errata/RHSA-2023:0512
- https://access.redhat.com/errata/RHSA-2023:0526
- https://access.redhat.com/errata/RHSA-2023:0536
- https://access.redhat.com/security/cve/cve-2022-2964
- https://security.netapp.com/advisory/ntap-20230113-0001/
- https://launchpad.net/bugs/cve/CVE-2022-2964
- https://www.spinics.net/lists/stable/msg536418.html
- https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=57bc3d3ae8c14df3ceb4e17d26ddf9eeab304581
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2076784
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-2964
- https://nvd.nist.gov/vuln/detail/CVE-2022-2964
- https://security-tracker.debian.org/tracker/CVE-2022-2964
- https://ubuntu.com/security/CVE-2022-2964
- https://git.kernel.org/linus/57bc3d3ae8c14df3ceb4e17d26ddf9eeab304581
- https://www.ibm.com/support/pages/node/7183851 (Advisory)
Parent vulnerabilities
(Appears in the following advisories)
- RHSA-2023:0400
- RHSA-2023:0399
- RHSA-2023:0404
- RHSA-2023:0114
- RHSA-2023:0101
- RHSA-2023:0123
- RHSA-2023:0856
- RHSA-2023:0858
- RHSA-2023:0395
- RHSA-2023:0392
- RHSA-2023:0396
- RHSA-2023:0531
- RHSA-2023:0496
- RHSA-2023:0499
- RHSA-2023:1130
- RHSA-2023:1192
- RHSA-2023:0334
- RHSA-2023:0300
- RHSA-2023:0348
- RHSA-2023:0512
- RHSA-2023:0526
- RHSA-2023:0536
- IBM-7183851
Frequently Asked Questions
What is the severity of CVE-2022-2964?
CVE-2022-2964 has been classified with a medium severity due to multiple out-of-bounds reads and possible writes that can impact system stability.
How do I fix CVE-2022-2964?
To fix CVE-2022-2964, upgrade to the appropriate kernel versions specified for your distribution, such as kernel-rt 3.10.0-1160.83.1.el7 or later.
Which systems are affected by CVE-2022-2964?
CVE-2022-2964 affects Linux kernels ranging from 3.10.0 to 5.14.0, impacting systems that utilize ASIX AX88179_178A-based USB Ethernet devices.
Is CVE-2022-2964 related to specific Linux distributions?
Yes, CVE-2022-2964 predominantly affects Red Hat Enterprise Linux versions 7, 8, and 9, among other Linux distributions.
What are the potential risks of CVE-2022-2964 if not mitigated?
If not mitigated, CVE-2022-2964 could lead to unauthorized access, data corruption, or service disruptions due to out-of-bounds memory operations.
- collector/redhat-cve
- agent/type
- agent/first-publish-date
- collector/launchpad-cve
- source/Launchpad
- agent/weakness
- agent/severity
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2022-2964
- agent/software-canonical-lookup
- collector/mitre-cve
- source/MITRE
- collector/usn-cve
- source/Ubuntu
- agent/remedy
- agent/trending
- collector/nvd-cve
- source/NVD
- agent/software-canonical-lookup-request
- collector/nvd-index
- agent/author
- collector/security-tracker-debian
- source/Debian
- agent/references
- agent/last-modified-date
- agent/source
- agent/description
- agent/event
- agent/softwarecombine
- agent/tags
- collector/ibm-support
- source/IBM
- package-manager/redhat
- vendor/linux
- canonical/linux kernel
- version/linux kernel/4.20
- version/linux kernel/5.5
- version/linux kernel/5.11
- version/linux kernel/5.16
- vendor/redhat
- canonical/red hat enterprise linux
- version/red hat enterprise linux/7.0
- version/red hat enterprise linux/8.0
- version/red hat enterprise linux/9.0
- vendor/netapp
- canonical/netapp h300s firmware
- canonical/netapp h300s
- canonical/netapp h500s firmware
- canonical/netapp h500s
- canonical/netapp h700s firmware
- canonical/netapp h700s
- canonical/netapp h410s firmware
- canonical/netapp h410s
- canonical/netapp h410c firmware
- canonical/netapp h410c
- package-manager/debian
- vendor/ibm
- canonical/ibm data virtualization on cloud pak for data
- version/ibm data virtualization on cloud pak for data/3.0
- canonical/ibm watson query with cloud pak for data as a service
- version/ibm watson query with cloud pak for data as a service/2.2
- version/ibm watson query with cloud pak for data as a service/2.1
- version/ibm watson query with cloud pak for data as a service/2.0
- version/ibm data virtualization on cloud pak for data/1.8
- version/ibm data virtualization on cloud pak for data/1.7