中危
Linux kernel packet_set_ring()特权提升漏洞
2022-01-26 00:00:00 公开 ，2025-10-22 00:21:40 更新
- 关键漏洞
- CISA KEV
- 本地
- 开源组件漏洞
- 公开PoC
- CWEs：
- CWE-415 （Double Free）
- SSVC：
- 可利用状态：已被积极利用攻击自动化：否技术影响评估：部分 2025-01-30 04:47:54
风险信息
- CVSS v2 向量
- AV:L/AC:L/Au:N/C:C/I:C/A:C
- CVSS v2 风险值
- 7.2
- CVSS v3 向量
- AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
- CVSS v3 风险值
- 7
- CVSS v3.1 向量
- AV:L/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:H
- CVSS v3.1 风险值
- 6.6
详细信息
- 漏洞类型
- 资源管理错误
- 漏洞描述
- Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。Linux kernel核可能允许经过本地身份验证的攻击者在系统上获得提升的权限，这是由net/packet/af_packet.c中的packet_set_ring()函数中的双重释放缺陷引起的。通过发送特制的系统调用，攻击者可以利用此漏洞获得提升的权限或导致拒绝服务条件。
- 修复建议
- 有关补丁、升级或建议的解决方法信息，请参阅Linux内核GIT存储库： https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit?id=ec6af094ea28f0f2dda1a6a33b14cd57e36a9755
参考链接
- https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit?id=ec6af094ea28f0f2dda1a6a33b14cd57e36a9755
CVE · Mailing List · Patch
- https://www.auscert.org.au/bulletins/ESB-2022.0485
- https://packetstormsecurity.com/files/165839/Ubuntu-Security-Notice-USN-5266-1.html
- https://www.auscert.org.au/bulletins/ESB-2022.0613
- https://security.netapp.com/advisory/ntap-20230110-0002/
CVE · Third Party Advisory
- https://www.debian.org/security/2022/dsa-5096
CVE · vendor-advisory
- https://lists.debian.org/debian-lts-announce/2022/03/msg00012.html
CVE · mailing-list
- https://gitee.com/openharmony/security/blob/master/zh/security-disclosure/2022/2022-05.md
- https://source.android.com/security/bulletin/2022-05-01
OSV
- https://android.googlesource.com/kernel/common/+/27fc5a7c6972bd73ac0cc0cf811ec2ecb989014f
OSV
- https://osv.dev/vulnerability/ASB-A-213464034
OSV
- https://osv.dev/vulnerability/DSA-5096-1
OSV
- https://osv.dev/vulnerability/DLA-2941-1
OSV
- https://device.harmonyos.com/cn/docs/security/update/security-bulletins-phones-202204-0000001224076294
HarmonyOS
- https://ubuntu.com/security/CVE-2021-22600
OSV
- https://ubuntu.com/security/notices/USN-5266-1
OSV
- https://ubuntu.com/security/notices/USN-5278-1
OSV
- https://ubuntu.com/security/notices/USN-5294-1
OSV
- https://ubuntu.com/security/notices/USN-5295-1
OSV
- https://ubuntu.com/security/notices/USN-5294-2
OSV
- https://ubuntu.com/security/notices/USN-5295-2
OSV
- https://ubuntu.com/security/notices/USN-5298-1
OSV
- https://www.cve.org/CVERecord?id=CVE-2021-22600
OSV
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog
OSV
- https://osv.dev/vulnerability/UBUNTU-CVE-2021-22600
OSV
- https://security-tracker.debian.org/tracker/CVE-2021-22600
OSV
- https://osv.dev/vulnerability/CVE-2021-22600
OSV
- https://source.android.com/security/bulletin/2022-03-01
OSV
- https://osv.dev/vulnerability/PUB-A-213464034
OSV
- https://osv.dev/vulnerability/DEBIAN-CVE-2021-22600
OSV
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-22600
NVD