CVE-2022-3977: Use After Free
A use-after-free flaw was found in the Linux kernel MCTP (Management Component Transport Protocol) functionality. This issue occurs when a user simultaneously calls DROPTAG ioctl and socket close happens, which could allow a local user to crash the system or potentially escalate their privileges on the system.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.25-1
Event History
Frequently Asked Questions
What is the severity of CVE-2022-3977?
CVE-2022-3977 is classified as a high severity vulnerability due to its potential to allow local users to crash the system or escalate privileges.
How do I fix CVE-2022-3977?
To fix CVE-2022-3977, upgrade the Linux kernel to one of the patched versions such as 5.10.223-1, 5.10.226-1, 6.1.123-1, or later.
Which software is affected by CVE-2022-3977?
CVE-2022-3977 affects multiple versions of the Linux kernel, specifically those between 5.18 and 5.19.16 and those between 6.0 and 6.0.2.
What type of vulnerability is CVE-2022-3977?
CVE-2022-3977 is a use-after-free vulnerability found in the MCTP functionality of the Linux kernel.
Can CVE-2022-3977 be exploited remotely?
No, CVE-2022-3977 can only be exploited locally by authenticated users.