CVE-2022-40768: Medium severity Linux Linux kernel vulnerability
drivers/scsi/stex.c in the Linux kernel through 5.19.9 allows local users to obtain sensitive information from kernel memory because stexqueuecommandlck lacks a memset for the PASSTHRUCMD case.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.25-1Fixed in 6.12.27-1 - Upgrade
Upgrade
Linux kernel stex driver (drivers/scsi/stex.c)to a version that resolves this vulnerability.Fixed in 5.19.9
Event History
Frequently Asked Questions
What is the severity of CVE-2022-40768?
CVE-2022-40768 is classified as a medium severity vulnerability affecting the Linux kernel.
How do I fix CVE-2022-40768?
To fix CVE-2022-40768, update your Linux kernel to version 5.19.10 or later.
Which versions of the Linux kernel are affected by CVE-2022-40768?
CVE-2022-40768 affects the Linux kernel versions up to and including 5.19.9.
Can CVE-2022-40768 allow unauthorized access to sensitive data?
Yes, CVE-2022-40768 can potentially allow local users to obtain sensitive information from kernel memory.
Is CVE-2022-40768 specific to any particular Linux distribution?
CVE-2022-40768 affects multiple distributions including Fedora 35, 36, 37 and Debian Linux 10.0.