CVE-2022-40307: Race Condition
An issue was discovered in the Linux kernel through 5.19.8. drivers/firmware/efi/capsule-loader.c has a race condition with a resultant use-after-free.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.25-1Fixed in 6.12.27-1
Event History
Frequently Asked Questions
What is the severity of CVE-2022-40307?
CVE-2022-40307 is classified as a medium severity vulnerability due to the potential for a use-after-free condition in the Linux kernel.
How do I fix CVE-2022-40307?
To fix CVE-2022-40307, update the Linux kernel to a version newer than 5.19.8 or apply the appropriate patches provided by your Linux distribution.
Which versions of the Linux kernel are affected by CVE-2022-40307?
CVE-2022-40307 affects the Linux kernel versions up to and including 5.19.8.
Is Debian Linux affected by CVE-2022-40307?
Yes, Debian Linux versions 10.0 and 11.0 are vulnerable to CVE-2022-40307 before applying the necessary updates.
What is a use-after-free vulnerability in CVE-2022-40307?
A use-after-free vulnerability occurs when a program continues to use a memory location after it has been freed, potentially leading to arbitrary code execution.