Vulnerability Details : CVE-2022-0494
Potential exploit
A kernel information leak flaw was identified in the scsi_ioctl function in drivers/scsi/scsi_ioctl.c in the Linux kernel. This flaw allows a local attacker with a special user privilege (CAP_SYS_ADMIN or CAP_SYS_RAWIO) to create issues with confidentiality.
Vulnerability category: Information leak
Products affected by CVE-2022-0494
- cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
- cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
- cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*
- cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
- cpe:2.3:o:linux:linux_kernel:5.17:rc1:*:*:*:*:*:*
- cpe:2.3:o:linux:linux_kernel:5.17:rc2:*:*:*:*:*:*
- cpe:2.3:o:linux:linux_kernel:5.17:rc3:*:*:*:*:*:*
- cpe:2.3:o:linux:linux_kernel:5.17:rc4:*:*:*:*:*:*
- cpe:2.3:o:linux:linux_kernel:5.17:-:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2022-0494
0.04%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 6 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2022-0494
Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
---|---|---|---|---|---|---|
4.9
|
MEDIUM | AV:L/AC:L/Au:N/C:C/I:N/A:N |
3.9
|
6.9
|
NIST | |
4.4
|
MEDIUM | CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N |
0.8
|
3.6
|
NIST |
CWE ids for CVE-2022-0494
-
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.Assigned by:
- nvd@nist.gov (Primary)
- secalert@redhat.com (Secondary)
-
The product uses or accesses a resource that has not been initialized.Assigned by: nvd@nist.gov (Primary)
References for CVE-2022-0494
-
https://lists.debian.org/debian-lts-announce/2022/07/msg00000.html
[SECURITY] [DLA 3065-1] linux security updateMailing List;Third Party Advisory
-
https://lore.kernel.org/all/20220216084038.15635-1-tcs.kernel@gmail.com/
[PATCH] block-map: add __GFP_ZERO flag for alloc_page in function bio_copy_kern - Haimin ZhangExploit;Mailing List;Vendor Advisory
-
https://www.debian.org/security/2022/dsa-5161
Debian -- Security Information -- DSA-5161-1 linuxThird Party Advisory
-
https://bugzilla.redhat.com/show_bug.cgi?id=2039448
2039448 – (CVE-2022-0494) CVE-2022-0494 kernel: information leak in scsi_ioctl()Issue Tracking
-
https://www.debian.org/security/2022/dsa-5173
Debian -- Security Information -- DSA-5173-1 linuxThird Party Advisory
Jump to