CVE-2022-49236 (GCVE-0-2022-49236)

Vulnerability from cvelistv5 – Published: 2025-02-26 01:56 – Updated: 2025-05-04 08:33
VLAI?
Title
bpf: Fix UAF due to race between btf_try_get_module and load_module
Summary
In the Linux kernel, the following vulnerability has been resolved: bpf: Fix UAF due to race between btf_try_get_module and load_module While working on code to populate kfunc BTF ID sets for module BTF from its initcall, I noticed that by the time the initcall is invoked, the module BTF can already be seen by userspace (and the BPF verifier). The existing btf_try_get_module calls try_module_get which only fails if mod->state == MODULE_STATE_GOING, i.e. it can increment module reference when module initcall is happening in parallel. Currently, BTF parsing happens from MODULE_STATE_COMING notifier callback. At this point, the module initcalls have not been invoked. The notifier callback parses and prepares the module BTF, allocates an ID, which publishes it to userspace, and then adds it to the btf_modules list allowing the kernel to invoke btf_try_get_module for the BTF. However, at this point, the module has not been fully initialized (i.e. its initcalls have not finished). The code in module.c can still fail and free the module, without caring for other users. However, nothing stops btf_try_get_module from succeeding between the state transition from MODULE_STATE_COMING to MODULE_STATE_LIVE. This leads to a use-after-free issue when BPF program loads successfully in the state transition, load_module's do_init_module call fails and frees the module, and BPF program fd on close calls module_put for the freed module. Future patch has test case to verify we don't regress in this area in future. There are multiple points after prepare_coming_module (in load_module) where failure can occur and module loading can return error. We illustrate and test for the race using the last point where it can practically occur (in module __init function). An illustration of the race: CPU 0 CPU 1 load_module notifier_call(MODULE_STATE_COMING) btf_parse_module btf_alloc_id // Published to userspace list_add(&btf_mod->list, btf_modules) mod->init(...) ... ^ bpf_check | check_pseudo_btf_id | btf_try_get_module | returns true | ... ... | module __init in progress return prog_fd | ... ... V if (ret < 0) free_module(mod) ... close(prog_fd) ... bpf_prog_free_deferred module_put(used_btf.mod) // use-after-free We fix this issue by setting a flag BTF_MODULE_F_LIVE, from the notifier callback when MODULE_STATE_LIVE state is reached for the module, so that we return NULL from btf_try_get_module for modules that are not fully formed. Since try_module_get already checks that module is not in MODULE_STATE_GOING state, and that is the only transition a live module can make before being removed from btf_modules list, this is enough to close the race and prevent the bug. A later selftest patch crafts the race condition artifically to verify that it has been fixed, and that verifier fails to load program (with ENXIO). Lastly, a couple of comments: 1. Even if this race didn't exist, it seems more appropriate to only access resources (ksyms and kfuncs) of a fully formed module which has been initialized completely. 2. This patch was born out of need for synchronization against module initcall for the next patch, so it is needed for correctness even without the aforementioned race condition. The BTF resources initialized by module initcall are set up once and then only looked up, so just waiting until the initcall has finished ensures correct behavior.
Severity ?
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 541c3bad8dc51b253ba8686d0cd7628e6b9b5f4c , < 51b82141fffa454abf937a8ff0b8af89e4fd0c8f (git)
Affected: 541c3bad8dc51b253ba8686d0cd7628e6b9b5f4c , < d7fccf264b1a785525b366a5b7f8113c756187ad (git)
Affected: 541c3bad8dc51b253ba8686d0cd7628e6b9b5f4c , < 0481baa2318cb1ab13277715da6cdbb657807b3f (git)
Affected: 541c3bad8dc51b253ba8686d0cd7628e6b9b5f4c , < 18688de203b47e5d8d9d0953385bf30b5949324f (git)
Create a notification for this product.
    Linux Linux Affected: 5.12
Unaffected: 0 , < 5.12 (semver)
Unaffected: 5.15.33 , ≤ 5.15.* (semver)
Unaffected: 5.16.19 , ≤ 5.16.* (semver)
Unaffected: 5.17.2 , ≤ 5.17.* (semver)
Unaffected: 5.18 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 7.8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2022-49236",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-02-27T17:58:59.008541Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-416",
                "description": "CWE-416 Use After Free",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-02-27T18:02:29.374Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "kernel/bpf/btf.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "51b82141fffa454abf937a8ff0b8af89e4fd0c8f",
              "status": "affected",
              "version": "541c3bad8dc51b253ba8686d0cd7628e6b9b5f4c",
              "versionType": "git"
            },
            {
              "lessThan": "d7fccf264b1a785525b366a5b7f8113c756187ad",
              "status": "affected",
              "version": "541c3bad8dc51b253ba8686d0cd7628e6b9b5f4c",
              "versionType": "git"
            },
            {
              "lessThan": "0481baa2318cb1ab13277715da6cdbb657807b3f",
              "status": "affected",
              "version": "541c3bad8dc51b253ba8686d0cd7628e6b9b5f4c",
              "versionType": "git"
            },
            {
              "lessThan": "18688de203b47e5d8d9d0953385bf30b5949324f",
              "status": "affected",
              "version": "541c3bad8dc51b253ba8686d0cd7628e6b9b5f4c",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "kernel/bpf/btf.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.12"
            },
            {
              "lessThan": "5.12",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.33",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.16.*",
              "status": "unaffected",
              "version": "5.16.19",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.17.*",
              "status": "unaffected",
              "version": "5.17.2",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "5.18",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.33",
                  "versionStartIncluding": "5.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.16.19",
                  "versionStartIncluding": "5.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.17.2",
                  "versionStartIncluding": "5.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.18",
                  "versionStartIncluding": "5.12",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Fix UAF due to race between btf_try_get_module and load_module\n\nWhile working on code to populate kfunc BTF ID sets for module BTF from\nits initcall, I noticed that by the time the initcall is invoked, the\nmodule BTF can already be seen by userspace (and the BPF verifier). The\nexisting btf_try_get_module calls try_module_get which only fails if\nmod-\u003estate == MODULE_STATE_GOING, i.e. it can increment module reference\nwhen module initcall is happening in parallel.\n\nCurrently, BTF parsing happens from MODULE_STATE_COMING notifier\ncallback. At this point, the module initcalls have not been invoked.\nThe notifier callback parses and prepares the module BTF, allocates an\nID, which publishes it to userspace, and then adds it to the btf_modules\nlist allowing the kernel to invoke btf_try_get_module for the BTF.\n\nHowever, at this point, the module has not been fully initialized (i.e.\nits initcalls have not finished). The code in module.c can still fail\nand free the module, without caring for other users. However, nothing\nstops btf_try_get_module from succeeding between the state transition\nfrom MODULE_STATE_COMING to MODULE_STATE_LIVE.\n\nThis leads to a use-after-free issue when BPF program loads\nsuccessfully in the state transition, load_module\u0027s do_init_module call\nfails and frees the module, and BPF program fd on close calls module_put\nfor the freed module. Future patch has test case to verify we don\u0027t\nregress in this area in future.\n\nThere are multiple points after prepare_coming_module (in load_module)\nwhere failure can occur and module loading can return error. We\nillustrate and test for the race using the last point where it can\npractically occur (in module __init function).\n\nAn illustration of the race:\n\nCPU 0                           CPU 1\n\t\t\t  load_module\n\t\t\t    notifier_call(MODULE_STATE_COMING)\n\t\t\t      btf_parse_module\n\t\t\t      btf_alloc_id\t// Published to userspace\n\t\t\t      list_add(\u0026btf_mod-\u003elist, btf_modules)\n\t\t\t    mod-\u003einit(...)\n...\t\t\t\t^\nbpf_check\t\t        |\ncheck_pseudo_btf_id             |\n  btf_try_get_module            |\n    returns true                |  ...\n...                             |  module __init in progress\nreturn prog_fd                  |  ...\n...                             V\n\t\t\t    if (ret \u003c 0)\n\t\t\t      free_module(mod)\n\t\t\t    ...\nclose(prog_fd)\n ...\n bpf_prog_free_deferred\n  module_put(used_btf.mod) // use-after-free\n\nWe fix this issue by setting a flag BTF_MODULE_F_LIVE, from the notifier\ncallback when MODULE_STATE_LIVE state is reached for the module, so that\nwe return NULL from btf_try_get_module for modules that are not fully\nformed. Since try_module_get already checks that module is not in\nMODULE_STATE_GOING state, and that is the only transition a live module\ncan make before being removed from btf_modules list, this is enough to\nclose the race and prevent the bug.\n\nA later selftest patch crafts the race condition artifically to verify\nthat it has been fixed, and that verifier fails to load program (with\nENXIO).\n\nLastly, a couple of comments:\n\n 1. Even if this race didn\u0027t exist, it seems more appropriate to only\n    access resources (ksyms and kfuncs) of a fully formed module which\n    has been initialized completely.\n\n 2. This patch was born out of need for synchronization against module\n    initcall for the next patch, so it is needed for correctness even\n    without the aforementioned race condition. The BTF resources\n    initialized by module initcall are set up once and then only looked\n    up, so just waiting until the initcall has finished ensures correct\n    behavior."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-05-04T08:33:04.114Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/51b82141fffa454abf937a8ff0b8af89e4fd0c8f"
        },
        {
          "url": "https://git.kernel.org/stable/c/d7fccf264b1a785525b366a5b7f8113c756187ad"
        },
        {
          "url": "https://git.kernel.org/stable/c/0481baa2318cb1ab13277715da6cdbb657807b3f"
        },
        {
          "url": "https://git.kernel.org/stable/c/18688de203b47e5d8d9d0953385bf30b5949324f"
        }
      ],
      "title": "bpf: Fix UAF due to race between btf_try_get_module and load_module",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2022-49236",
    "datePublished": "2025-02-26T01:56:00.689Z",
    "dateReserved": "2025-02-26T01:49:39.294Z",
    "dateUpdated": "2025-05-04T08:33:04.114Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 7.8, \"attackVector\": \"LOCAL\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"HIGH\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2022-49236\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-02-27T17:58:59.008541Z\"}}}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-416\", \"description\": \"CWE-416 Use After Free\"}]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-02-27T17:59:00.505Z\"}}], \"cna\": {\"title\": \"bpf: Fix UAF due to race between btf_try_get_module and load_module\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"541c3bad8dc51b253ba8686d0cd7628e6b9b5f4c\", \"lessThan\": \"51b82141fffa454abf937a8ff0b8af89e4fd0c8f\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"541c3bad8dc51b253ba8686d0cd7628e6b9b5f4c\", \"lessThan\": \"d7fccf264b1a785525b366a5b7f8113c756187ad\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"541c3bad8dc51b253ba8686d0cd7628e6b9b5f4c\", \"lessThan\": \"0481baa2318cb1ab13277715da6cdbb657807b3f\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"541c3bad8dc51b253ba8686d0cd7628e6b9b5f4c\", \"lessThan\": \"18688de203b47e5d8d9d0953385bf30b5949324f\", \"versionType\": \"git\"}], \"programFiles\": [\"kernel/bpf/btf.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"5.12\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"5.12\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"5.15.33\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.15.*\"}, {\"status\": \"unaffected\", \"version\": \"5.16.19\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.16.*\"}, {\"status\": \"unaffected\", \"version\": \"5.17.2\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.17.*\"}, {\"status\": \"unaffected\", \"version\": \"5.18\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"kernel/bpf/btf.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/51b82141fffa454abf937a8ff0b8af89e4fd0c8f\"}, {\"url\": \"https://git.kernel.org/stable/c/d7fccf264b1a785525b366a5b7f8113c756187ad\"}, {\"url\": \"https://git.kernel.org/stable/c/0481baa2318cb1ab13277715da6cdbb657807b3f\"}, {\"url\": \"https://git.kernel.org/stable/c/18688de203b47e5d8d9d0953385bf30b5949324f\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nbpf: Fix UAF due to race between btf_try_get_module and load_module\\n\\nWhile working on code to populate kfunc BTF ID sets for module BTF from\\nits initcall, I noticed that by the time the initcall is invoked, the\\nmodule BTF can already be seen by userspace (and the BPF verifier). The\\nexisting btf_try_get_module calls try_module_get which only fails if\\nmod-\u003estate == MODULE_STATE_GOING, i.e. it can increment module reference\\nwhen module initcall is happening in parallel.\\n\\nCurrently, BTF parsing happens from MODULE_STATE_COMING notifier\\ncallback. At this point, the module initcalls have not been invoked.\\nThe notifier callback parses and prepares the module BTF, allocates an\\nID, which publishes it to userspace, and then adds it to the btf_modules\\nlist allowing the kernel to invoke btf_try_get_module for the BTF.\\n\\nHowever, at this point, the module has not been fully initialized (i.e.\\nits initcalls have not finished). The code in module.c can still fail\\nand free the module, without caring for other users. However, nothing\\nstops btf_try_get_module from succeeding between the state transition\\nfrom MODULE_STATE_COMING to MODULE_STATE_LIVE.\\n\\nThis leads to a use-after-free issue when BPF program loads\\nsuccessfully in the state transition, load_module\u0027s do_init_module call\\nfails and frees the module, and BPF program fd on close calls module_put\\nfor the freed module. Future patch has test case to verify we don\u0027t\\nregress in this area in future.\\n\\nThere are multiple points after prepare_coming_module (in load_module)\\nwhere failure can occur and module loading can return error. We\\nillustrate and test for the race using the last point where it can\\npractically occur (in module __init function).\\n\\nAn illustration of the race:\\n\\nCPU 0                           CPU 1\\n\\t\\t\\t  load_module\\n\\t\\t\\t    notifier_call(MODULE_STATE_COMING)\\n\\t\\t\\t      btf_parse_module\\n\\t\\t\\t      btf_alloc_id\\t// Published to userspace\\n\\t\\t\\t      list_add(\u0026btf_mod-\u003elist, btf_modules)\\n\\t\\t\\t    mod-\u003einit(...)\\n...\\t\\t\\t\\t^\\nbpf_check\\t\\t        |\\ncheck_pseudo_btf_id             |\\n  btf_try_get_module            |\\n    returns true                |  ...\\n...                             |  module __init in progress\\nreturn prog_fd                  |  ...\\n...                             V\\n\\t\\t\\t    if (ret \u003c 0)\\n\\t\\t\\t      free_module(mod)\\n\\t\\t\\t    ...\\nclose(prog_fd)\\n ...\\n bpf_prog_free_deferred\\n  module_put(used_btf.mod) // use-after-free\\n\\nWe fix this issue by setting a flag BTF_MODULE_F_LIVE, from the notifier\\ncallback when MODULE_STATE_LIVE state is reached for the module, so that\\nwe return NULL from btf_try_get_module for modules that are not fully\\nformed. Since try_module_get already checks that module is not in\\nMODULE_STATE_GOING state, and that is the only transition a live module\\ncan make before being removed from btf_modules list, this is enough to\\nclose the race and prevent the bug.\\n\\nA later selftest patch crafts the race condition artifically to verify\\nthat it has been fixed, and that verifier fails to load program (with\\nENXIO).\\n\\nLastly, a couple of comments:\\n\\n 1. Even if this race didn\u0027t exist, it seems more appropriate to only\\n    access resources (ksyms and kfuncs) of a fully formed module which\\n    has been initialized completely.\\n\\n 2. This patch was born out of need for synchronization against module\\n    initcall for the next patch, so it is needed for correctness even\\n    without the aforementioned race condition. The BTF resources\\n    initialized by module initcall are set up once and then only looked\\n    up, so just waiting until the initcall has finished ensures correct\\n    behavior.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.15.33\", \"versionStartIncluding\": \"5.12\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.16.19\", \"versionStartIncluding\": \"5.12\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.17.2\", \"versionStartIncluding\": \"5.12\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.18\", \"versionStartIncluding\": \"5.12\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2025-05-04T08:33:04.114Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2022-49236\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-05-04T08:33:04.114Z\", \"dateReserved\": \"2025-02-26T01:49:39.294Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2025-02-26T01:56:00.689Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.