CVE-2022-3594: Linux Kernel BPF r8152.c intr_callback logging of excessive data
A vulnerability was found in Linux Kernel in intrcallback in drivers/net/usb/r8152.c. The manipulation leads to logging of excessive data. The attack can be launched remotely.
https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next.git/commit/?id=93e2be344a7db169b7119de21ac1bf253b8c6907
Other sources
A vulnerability was found in Linux Kernel. It has been declared as problematic. Affected by this vulnerability is the function intrcallback of the file drivers/net/usb/r8152.c of the component BPF. The manipulation leads to logging of excessive data. The attack can be launched remotely. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-211363.
Linux Kernel is vulnerable to a denial of service, caused by an error in the function intrcallback of the file drivers/net/usb/r8152.c of the component BPF. A remote attacker could exploit this vulnerability to cause a denial of service.
— IBM
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 6.1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.0.3-1 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 4.4.0-1114.120 - Upgrade
Upgrade
ubuntu/linux-azureto a version that resolves this vulnerability.Fixed in 4.15.0-1157.172~14.04.2 - Upgrade
Upgrade
ubuntu/linux-lts-xenialto a version that resolves this vulnerability.Fixed in 4.4.0-235.269~14.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 4.4.0-235.269 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 4.4.0-1152.167 - Upgrade
Upgrade
ubuntu/linux-aws-hweto a version that resolves this vulnerability.Fixed in 4.15.0-1146.158~16.04.2 - Upgrade
Upgrade
ubuntu/linux-azureto a version that resolves this vulnerability.Fixed in 4.15.0-1159.174~16.04.1 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 4.15.0-1141.157~16.04.2 - Upgrade
Upgrade
ubuntu/linux-hweto a version that resolves this vulnerability.Fixed in 4.15.0-200.211~16.04.2 - Upgrade
Upgrade
ubuntu/linux-kvmto a version that resolves this vulnerability.Fixed in 4.4.0-1115.125 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 4.15.0-1111.122~16.04.2 - Upgrade
Upgrade
ubuntu/linux-fipsto a version that resolves this vulnerability.Fixed in 4.4.0-1084.91 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 4.15.0-200.211 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 4.15.0-1146.158 - Upgrade
Upgrade
ubuntu/linux-aws-5.4to a version that resolves this vulnerability.Fixed in 5.4.0-1092.100~18.04.2 - Upgrade
Upgrade
ubuntu/linux-azure-4.15to a version that resolves this vulnerability.Fixed in 4.15.0-1157.172 - Upgrade
Upgrade
ubuntu/linux-azure-5.4to a version that resolves this vulnerability.Fixed in 5.4.0-1098.104~18.04.2 - Upgrade
Upgrade
ubuntu/linux-dell300xto a version that resolves this vulnerability.Fixed in 4.15.0-1057.62 - Upgrade
Upgrade
ubuntu/linux-gcp-4.15to a version that resolves this vulnerability.Fixed in 4.15.0-1141.157 - Upgrade
Upgrade
ubuntu/linux-gcp-5.4to a version that resolves this vulnerability.Fixed in 5.4.0-1096.105~18.04.2 - Upgrade
Upgrade
ubuntu/linux-hwe-5.4to a version that resolves this vulnerability.Fixed in 5.4.0-135.152~18.04.2 - Upgrade
Upgrade
ubuntu/linux-ibm-5.4to a version that resolves this vulnerability.Fixed in 5.4.0-1040.45~18.04.2 - Upgrade
Upgrade
ubuntu/linux-kvmto a version that resolves this vulnerability.Fixed in 4.15.0-1132.137 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 4.15.0-1111.122 - Upgrade
Upgrade
ubuntu/linux-oracle-5.4to a version that resolves this vulnerability.Fixed in 5.4.0-1090.99~18.04.2 - Upgrade
Upgrade
ubuntu/linux-raspi-5.4to a version that resolves this vulnerability.Fixed in 5.4.0-1077.88~18.04.2 - Upgrade
Upgrade
ubuntu/linux-raspi2to a version that resolves this vulnerability.Fixed in 4.15.0-1124.132 - Upgrade
Upgrade
ubuntu/linux-snapdragonto a version that resolves this vulnerability.Fixed in 4.15.0-1142.152 - Upgrade
Upgrade
ubuntu/linux-aws-fipsto a version that resolves this vulnerability.Fixed in 4.15.0-2085.91 - Upgrade
Upgrade
ubuntu/linux-azure-fipsto a version that resolves this vulnerability.Fixed in 4.15.0-2066.72 - Upgrade
Upgrade
ubuntu/linux-fipsto a version that resolves this vulnerability.Fixed in 4.15.0-1103.114 - Upgrade
Upgrade
ubuntu/linux-gcp-fipsto a version that resolves this vulnerability.Fixed in 4.15.0-2050.55 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 5.4.0-135.152 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 5.4.0-1092.100 - Upgrade
Upgrade
ubuntu/linux-aws-5.15to a version that resolves this vulnerability.Fixed in 5.15.0-1026.30~20.04.2 - Upgrade
Upgrade
ubuntu/linux-azureto a version that resolves this vulnerability.Fixed in 5.4.0-1098.104 - Upgrade
Upgrade
ubuntu/linux-azure-5.15to a version that resolves this vulnerability.Fixed in 5.15.0-1029.36~20.04.1 - Upgrade
Upgrade
ubuntu/linux-bluefieldto a version that resolves this vulnerability.Fixed in 5.4.0-1054.60 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 5.4.0-1096.105 - Upgrade
Upgrade
ubuntu/linux-gcp-5.15to a version that resolves this vulnerability.Fixed in 5.15.0-1025.32~20.04.2 - Upgrade
Upgrade
ubuntu/linux-gketo a version that resolves this vulnerability.Fixed in 5.4.0-1090.97 - Upgrade
Upgrade
ubuntu/linux-gke-5.15to a version that resolves this vulnerability.Fixed in 5.15.0-1023.28~20.04.2 - Upgrade
Upgrade
ubuntu/linux-gkeopto a version that resolves this vulnerability.Fixed in 5.4.0-1060.64 - Upgrade
Upgrade
ubuntu/linux-gkeop-5.15to a version that resolves this vulnerability.Fixed in 5.15.0-1011.15~20.04.2 - Upgrade
Upgrade
ubuntu/linux-hwe-5.15to a version that resolves this vulnerability.Fixed in 5.15.0-56.62~20.04.1 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 5.4.0-1040.45 - Upgrade
Upgrade
ubuntu/linux-intel-iotg-5.15to a version that resolves this vulnerability.Fixed in 5.15.0-1021.26~20.04.1 - Upgrade
Upgrade
ubuntu/linux-iotto a version that resolves this vulnerability.Fixed in 5.4.0-1009.11 - Upgrade
Upgrade
ubuntu/linux-kvmto a version that resolves this vulnerability.Fixed in 5.4.0-1082.88 - Upgrade
Upgrade
ubuntu/linux-lowlatency-hwe-5.15to a version that resolves this vulnerability.Fixed in 5.15.0-56.62~20.04.1 - Upgrade
Upgrade
ubuntu/linux-oem-5.14to a version that resolves this vulnerability.Fixed in 5.14.0-1055.62 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 5.4.0-1090.99 - Upgrade
Upgrade
ubuntu/linux-oracle-5.15to a version that resolves this vulnerability.Fixed in 5.15.0-1025.31~20.04.2 - Upgrade
Upgrade
ubuntu/linux-raspito a version that resolves this vulnerability.Fixed in 5.4.0-1077.88 - Upgrade
Upgrade
ubuntu/linux-riscv-5.15to a version that resolves this vulnerability.Fixed in 5.15.0-1026.30~20.04.2 - Upgrade
Upgrade
ubuntu/linux-aws-fipsto a version that resolves this vulnerability.Fixed in 5.4.0-1092.100+fips1 - Upgrade
Upgrade
ubuntu/linux-azure-fipsto a version that resolves this vulnerability.Fixed in 5.4.0-1098.104+fips1 - Upgrade
Upgrade
ubuntu/linux-fipsto a version that resolves this vulnerability.Fixed in 5.4.0-1068.77 - Upgrade
Upgrade
ubuntu/linux-gcp-fipsto a version that resolves this vulnerability.Fixed in 5.4.0-1096.105+fips1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 5.15.0-56.62 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 5.15.0-1026.30 - Upgrade
Upgrade
ubuntu/linux-azureto a version that resolves this vulnerability.Fixed in 5.15.0-1029.36 - Upgrade
Upgrade
ubuntu/linux-azure-fdeto a version that resolves this vulnerability.Fixed in 5.15.0-1029.36.1 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 5.15.0-1025.32 - Upgrade
Upgrade
ubuntu/linux-gketo a version that resolves this vulnerability.Fixed in 5.15.0-1023.28 - Upgrade
Upgrade
ubuntu/linux-gkeopto a version that resolves this vulnerability.Fixed in 5.15.0-1011.15 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 5.15.0-1021.24 - Upgrade
Upgrade
ubuntu/linux-intel-iotgto a version that resolves this vulnerability.Fixed in 5.15.0-1021.26 - Upgrade
Upgrade
ubuntu/linux-kvmto a version that resolves this vulnerability.Fixed in 5.15.0-1024.29 - Upgrade
Upgrade
ubuntu/linux-lowlatencyto a version that resolves this vulnerability.Fixed in 5.15.0-56.62 - Upgrade
Upgrade
ubuntu/linux-nvidiato a version that resolves this vulnerability.Fixed in 5.15.0-1015.15 - Upgrade
Upgrade
ubuntu/linux-oem-5.17to a version that resolves this vulnerability.Fixed in 5.17.0-1024.25 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 5.15.0-1025.31 - Upgrade
Upgrade
ubuntu/linux-raspito a version that resolves this vulnerability.Fixed in 5.15.0-1021.23 - Upgrade
Upgrade
ubuntu/linux-realtimeto a version that resolves this vulnerability.Fixed in 5.15.0-1028.31
Event History
Frequently Asked Questions
What is the severity of CVE-2022-3594?
CVE-2022-3594 is classified as a medium severity vulnerability that leads to excessive data logging.
How do I fix CVE-2022-3594?
To fix CVE-2022-3594, update the Linux kernel to version 6.1 or apply the recommended patches from your distribution.
Which software is affected by CVE-2022-3594?
CVE-2022-3594 affects various versions of the Linux Kernel, specifically prior to 6.1, and components of IBM Security Verify Governance.
Can CVE-2022-3594 be exploited remotely?
Yes, CVE-2022-3594 can be exploited remotely, allowing attackers to potentially manipulate data logging processes.
What type of vulnerability is CVE-2022-3594?
CVE-2022-3594 is a vulnerability found in the Linux Kernel concerning data logging in the USB driver.