Linux Kernel CIFS fs/cifs/sess.c sess_free_buffer double free

A vulnerability was found in Linux Kernel. It has been rated as problematic. Affected by this issue is the function sess_free_buffer of the file fs/cifs/sess.c of the component CIFS Handler. The manipulation leads to double free. Using CWE to declare the problem leads to CWE-415. The weakness was shared 10/18/2022. The advisory is shared for download at git.kernel.org. This vulnerability is handled as CVE-2022-3595. Access to the local network is required for this attack to succeed. Technical details are available. There is no exploit available. The current price for an exploit might be approx. USD $0-$5k at the moment. It is declared as not defined. As 0-day the estimated underground price was around $5k-$25k. The bugfix is ready for download at git.kernel.org. It is recommended to apply a patch to fix this issue. A possible mitigation has been published before and not just after the disclosure of the vulnerability.

Field10/18/2022 10:06 PM11/10/2022 11:12 AM11/10/2022 11:20 AM
vendorLinuxLinuxLinux
nameKernelKernelKernel
componentCIFS HandlerCIFS HandlerCIFS Handler
filefs/cifs/sess.cfs/cifs/sess.cfs/cifs/sess.c
functionsess_free_buffersess_free_buffersess_free_buffer
cwe415 (double free)415 (double free)415 (double free)
risk111
cvss3_vuldb_acLLL
cvss3_vuldb_uiNNN
cvss3_vuldb_sUUU
cvss3_vuldb_cNNN
cvss3_vuldb_iNNN
cvss3_vuldb_aLLL
cvss3_vuldb_rlOOO
cvss3_vuldb_rcCCC
urlhttps://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=b854b4ee66437e6e1622fda90529c814978cb4cahttps://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=b854b4ee66437e6e1622fda90529c814978cb4cahttps://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=b854b4ee66437e6e1622fda90529c814978cb4ca
namePatchPatchPatch
patch_urlhttps://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=b854b4ee66437e6e1622fda90529c814978cb4cahttps://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=b854b4ee66437e6e1622fda90529c814978cb4cahttps://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=b854b4ee66437e6e1622fda90529c814978cb4ca
cveCVE-2022-3595CVE-2022-3595CVE-2022-3595
responsibleVulDBVulDBVulDB
date1666044000 (10/18/2022)1666044000 (10/18/2022)1666044000 (10/18/2022)
typeOperating SystemOperating SystemOperating System
cvss2_vuldb_acLLL
cvss2_vuldb_ciNNN
cvss2_vuldb_iiNNN
cvss2_vuldb_aiPPP
cvss2_vuldb_rcCCC
cvss2_vuldb_rlOFOFOF
cvss2_vuldb_avAAA
cvss2_vuldb_auSSS
cvss2_vuldb_eNDNDND
cvss3_vuldb_avAAA
cvss3_vuldb_prLLL
cvss3_vuldb_eXXX
cvss2_vuldb_basescore2.72.72.7
cvss2_vuldb_tempscore2.32.32.3
cvss3_vuldb_basescore3.53.53.5
cvss3_vuldb_tempscore3.43.43.4
cvss3_meta_basescore3.53.54.2
cvss3_meta_tempscore3.43.44.1
price_0day$5k-$25k$5k-$25k$5k-$25k
cve_assigned1666044000 (10/18/2022)1666044000 (10/18/2022)
cve_nvd_summaryA vulnerability was found in Linux Kernel. It has been rated as problematic. Affected by this issue is the function sess_free_buffer of the file fs/cifs/sess.c of the component CIFS Handler. The manipulation leads to double free. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-211364.A vulnerability was found in Linux Kernel. It has been rated as problematic. Affected by this issue is the function sess_free_buffer of the file fs/cifs/sess.c of the component CIFS Handler. The manipulation leads to double free. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-211364.
cvss3_nvd_avL
cvss3_nvd_acL
cvss3_nvd_prL
cvss3_nvd_uiN
cvss3_nvd_sU
cvss3_nvd_cN
cvss3_nvd_iN
cvss3_nvd_aH
cvss3_cna_avA
cvss3_cna_acL
cvss3_cna_prL
cvss3_cna_uiN
cvss3_cna_sU
cvss3_cna_cN
cvss3_cna_iN
cvss3_cna_aL
cve_cnaVulDB
cvss3_nvd_basescore5.5
cvss3_cna_basescore3.5

Interested in the pricing of exploits?

See the underground prices here!