Linux Kernel 于 ARM64 BPF tools/lib/bpf/usdt.c parse_usdt_arg reg_name 拒绝服务

Linux Kernel中曾发现一漏洞,此漏洞被评为棘手。 此漏洞会影响功能 parse_usdt_arg文件tools/lib/bpf/usdt.c的组件BPF。 手动调试的软件参数:reg_name不合法输入可导致 拒绝服务。 漏洞的CWE定义是 CWE-401。 此漏洞的脆弱性 2022-10-17所发布。 阅读公告的网址是git.kernel.org。 该漏洞被标识为CVE-2022-3533, 成功的攻击必须要先进入局域网。 有技术细节可用。 没有可利用漏洞。 当前漏洞利用的价值为美元大约是$0-$5k 。 它被宣布为未定义。 我们估计的零日攻击价值约为$0-$5k。 错误修复程序下载地址为git.kernel.org, 建议采用一个补丁来修正此问题。 该漏洞被披露后,此前未曾发表过可能的缓解措施。

字段2022-10-17 08時09分2022-11-09 14時54分2022-11-09 14時56分
vendorLinuxLinuxLinux
nameKernelKernelKernel
platformARM64ARM64ARM64
filetools/lib/bpf/usdt.ctools/lib/bpf/usdt.ctools/lib/bpf/usdt.c
functionparse_usdt_argparse_usdt_argparse_usdt_arg
argumentreg_namereg_namereg_name
cwe401 (拒绝服务)401 (拒绝服务)401 (拒绝服务)
risk111
cvss3_vuldb_sUUU
cvss3_vuldb_cNNN
cvss3_vuldb_iNNN
cvss3_vuldb_aLLL
cvss3_vuldb_rlOOO
cvss3_vuldb_rcCCC
urlhttps://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next.git/commit/?id=0dc9254e03704c75f2ebc9cbef2ce4de83fba603https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next.git/commit/?id=0dc9254e03704c75f2ebc9cbef2ce4de83fba603https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next.git/commit/?id=0dc9254e03704c75f2ebc9cbef2ce4de83fba603
name补丁补丁补丁
patch_urlhttps://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next.git/commit/?id=0dc9254e03704c75f2ebc9cbef2ce4de83fba603https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next.git/commit/?id=0dc9254e03704c75f2ebc9cbef2ce4de83fba603https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next.git/commit/?id=0dc9254e03704c75f2ebc9cbef2ce4de83fba603
cveCVE-2022-3533CVE-2022-3533CVE-2022-3533
responsibleVulDBVulDBVulDB
date1665957600 (2022-10-17)1665957600 (2022-10-17)1665957600 (2022-10-17)
typeOperating SystemOperating SystemOperating System
cvss2_vuldb_ciNNN
cvss2_vuldb_iiNNN
cvss2_vuldb_aiPPP
cvss2_vuldb_rcCCC
cvss2_vuldb_rlOFOFOF
cvss2_vuldb_avAAA
cvss2_vuldb_acMMM
cvss2_vuldb_auSSS
cvss2_vuldb_eNDNDND
cvss3_vuldb_avAAA
cvss3_vuldb_acLLL
cvss3_vuldb_prLLL
cvss3_vuldb_uiNNN
cvss3_vuldb_eXXX
cvss2_vuldb_basescore2.32.32.3
cvss2_vuldb_tempscore2.02.02.0
cvss3_vuldb_basescore3.53.53.5
cvss3_vuldb_tempscore3.43.43.4
cvss3_meta_basescore3.53.54.2
cvss3_meta_tempscore3.43.44.2
price_0day$0-$5k$0-$5k$0-$5k
componentBPFBPFBPF
cve_assigned1665957600 (2022-10-17)1665957600 (2022-10-17)
cve_nvd_summaryA vulnerability was found in Linux Kernel. It has been rated as problematic. This issue affects the function parse_usdt_arg of the file tools/lib/bpf/usdt.c of the component BPF. The manipulation of the argument reg_name leads to memory leak. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-211031.A vulnerability was found in Linux Kernel. It has been rated as problematic. This issue affects the function parse_usdt_arg of the file tools/lib/bpf/usdt.c of the component BPF. The manipulation of the argument reg_name leads to memory leak. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-211031.
cvss3_nvd_avA
cvss3_nvd_acL
cvss3_nvd_prL
cvss3_nvd_uiN
cvss3_nvd_sU
cvss3_nvd_cN
cvss3_nvd_iN
cvss3_nvd_aH
cvss3_cna_avA
cvss3_cna_acL
cvss3_cna_prL
cvss3_cna_uiN
cvss3_cna_sU
cvss3_cna_cN
cvss3_cna_iN
cvss3_cna_aL
cve_cnaVulDB
cvss3_nvd_basescore5.7
cvss3_cna_basescore3.5

Do you know our Splunk app?

Download it now for free!