CVE-2022-2977: Use After Free
A flaw was found in the Linux kernel implementation of proxied virtualized TPM devices. On a system where virtualized TPM devices are configured (this is not the default) a local attacker can create a use-after-free and create a situation where it may be possible to escalate privileges on the system.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2022-2977?
CVE-2022-2977 is considered a high-severity vulnerability due to the potential for local privilege escalation.
How do I fix CVE-2022-2977?
To mitigate CVE-2022-2977, upgrade your Linux kernel to a version that is not affected by the vulnerability.
Which versions of the Linux kernel are affected by CVE-2022-2977?
CVE-2022-2977 affects Linux kernel versions between 4.12 and 5.17.1, specifically the versions 4.14.276 to 4.19.238, 4.20 to 5.4.189, 5.5 to 5.10.110, 5.11 to 5.15.33, and 5.16 to 5.16.19.
What type of attack can exploit CVE-2022-2977?
CVE-2022-2977 can be exploited by a local attacker to create a use-after-free condition, potentially leading to privilege escalation.
Is virtualized TPM device configuration a default setting for Linux systems regarding CVE-2022-2977?
No, the configuration of virtualized TPM devices is not a default setting in Linux systems.