CVE-2022-36879 : An issue was discovered in the Linux kernel through 5.18.14. xfrm_expand

An issue was discovered in the Linux kernel through 5.18.14. xfrm_expand_policies in net/xfrm/xfrm_policy.c can cause a refcount to be dropped twice.

Published 2022-07-27 04:15:11

Updated 2022-11-04 18:15:44

Source MITRE

View at NVD, CVE.org

Products affected by CVE-2022-36879

Debian » Debian Linux » Version: 10.0
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
Matching versions
Debian » Debian Linux » Version: 11.0
cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*
Matching versions
Linux » Linux Kernel
Versions up to, including, (<=) 5.18.14
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Matching versions
Netapp » E-series Santricity Os Controller
Versions from including (>=) 11.0 and up to, including, (<=) 11.50.2
cpe:2.3:a:netapp:e-series_santricity_os_controller:*:*:*:*:*:*:*:*
Matching versions
Netapp » Active Iq Unified Manager » Version: N/A For Vmware Vsphere
cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vmware_vsphere:*:*
Matching versions
Netapp » Aff A400 Firmware » Version: N/A
cpe:2.3:o:netapp:aff_a400_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Netapp » Aff A400 » Version: N/A
Netapp » H610s Firmware » Version: N/A
cpe:2.3:o:netapp:h610s_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Netapp » H610s » Version: N/A
Netapp » A700s Firmware » Version: N/A
cpe:2.3:o:netapp:a700s_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Netapp » A700s » Version: N/A
Netapp » H410c Firmware » Version: N/A
cpe:2.3:o:netapp:h410c_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Netapp » H410c » Version: N/A
Netapp » H300s Firmware » Version: N/A
cpe:2.3:o:netapp:h300s_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Netapp » H300s » Version: N/A
Netapp » H500s Firmware » Version: N/A
cpe:2.3:o:netapp:h500s_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Netapp » H500s » Version: N/A
Netapp » H700s Firmware » Version: N/A
cpe:2.3:o:netapp:h700s_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Netapp » H700s » Version: N/A
Netapp » H410s Firmware » Version: N/A
cpe:2.3:o:netapp:h410s_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Netapp » H410s » Version: N/A
Netapp » Aff 8300 Firmware » Version: N/A
cpe:2.3:o:netapp:aff_8300_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Netapp » Aff 8300 » Version: N/A
Netapp » Aff 8700 Firmware » Version: N/A
cpe:2.3:o:netapp:aff_8700_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Netapp » Aff 8700 » Version: N/A
Netapp » Aff A250 Firmware » Version: N/A
cpe:2.3:o:netapp:aff_a250_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Netapp » Aff A250 » Version: N/A
Netapp » Hci Bootstrap Os » Version: N/A
cpe:2.3:o:netapp:hci_bootstrap_os:-:*:*:*:*:*:*:*
Matching versions
Netapp » Fas 8300 Firmware » Version: N/A
cpe:2.3:o:netapp:fas_8300_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Netapp » Fas 8300 » Version: N/A
Netapp » Fas 8700 Firmware » Version: N/A
cpe:2.3:o:netapp:fas_8700_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Netapp » Fas 8700 » Version: N/A
Netapp » Aff 500f Firmware » Version: N/A
cpe:2.3:o:netapp:aff_500f_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Netapp » Aff 500f » Version: N/A
Netapp » H610c Firmware » Version: N/A
cpe:2.3:o:netapp:h610c_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Netapp » H610c » Version: N/A
Netapp » H615c Firmware » Version: N/A
cpe:2.3:o:netapp:h615c_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Netapp » H615c » Version: N/A
Netapp » Fas 500f Firmware » Version: N/A
cpe:2.3:o:netapp:fas_500f_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Netapp » Fas 500f » Version: N/A
Netapp » Fas A400 Firmware » Version: N/A
cpe:2.3:o:netapp:fas_a400_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Netapp » Fas A400 » Version: N/A
Netapp » Fas A250 Firmware » Version: N/A
cpe:2.3:o:netapp:fas_a250_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Netapp » Fas A250 » Version: N/A

Exploit prediction scoring system (EPSS) score for CVE-2022-36879

EPSS FAQ

0.05%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 12 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2022-36879

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source	First Seen
5.5	MEDIUM	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H	1.8	3.6	NIST
Attack Vector: Local Attack Complexity: Low Privileges Required: Low User Interaction: None Scope: Unchanged Confidentiality: None Integrity: None Availability: High

References for CVE-2022-36879

https://lists.debian.org/debian-lts-announce/2022/09/msg00011.html

[SECURITY] [DLA 3102-1] linux-5.10 new package
Mailing List;Third Party Advisory

CVEs referencing this url
https://lists.debian.org/debian-lts-announce/2022/10/msg00000.html

[SECURITY] [DLA 3131-1] linux security update
Mailing List;Third Party Advisory

CVEs referencing this url
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit?id=f85daf0e725358be78dfd208dea5fd665d8cb901

kernel/git/torvalds/linux.git - Linux kernel source tree
Mailing List;Patch;Third Party Advisory
https://github.com/torvalds/linux/commit/f85daf0e725358be78dfd208dea5fd665d8cb901

xfrm: xfrm_policy: fix a possible double xfrm_pols_put() in xfrm_bund… · torvalds/linux@f85daf0 · GitHub
Patch;Third Party Advisory
https://www.debian.org/security/2022/dsa-5207

Debian -- Security Information -- DSA-5207-1 linux
Third Party Advisory

CVEs referencing this url
https://security.netapp.com/advisory/ntap-20220901-0007/

July 2022 Linux Kernel Vulnerabilities in NetApp Products | NetApp Product Security
Third Party Advisory

CVEs referencing this url

Jump to

Vulnerability Details : CVE-2022-36879

Products affected by CVE-2022-36879

Exploit prediction scoring system (EPSS) score for CVE-2022-36879

CVSS scores for CVE-2022-36879

References for CVE-2022-36879