CVE-2022-1462

low-risk
Published 2022-06-02

An out-of-bounds read flaw was found in the Linux kernel’s TeleTYpe subsystem. The issue occurs in how a user triggers a race condition using ioctls TIOCSPTLCK and TIOCGPTPEER and TIOCSTI and TCXONC with leakage of memory in the flush_to_ldisc function. This flaw allows a local user to crash the system or read unauthorized random data from memory.

Do I need to act?

-
0.04% chance of exploitation
EPSS score — low exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
6
CVSS 6.3/10 Medium
LOCAL / HIGH complexity

Affected Products (4)

Affected Vendors

Debian Redhat Linux

References (6)

Issue Tracking https://bugzilla.redhat.com/show_bug.cgi?id=2078466
Mailing List https://lists.debian.org/debian-lts-announce/2022/10/msg00000.html
Exploit https://seclists.org/oss-sec/2022/q2/155
Issue Tracking https://bugzilla.redhat.com/show_bug.cgi?id=2078466
Mailing List https://lists.debian.org/debian-lts-announce/2022/10/msg00000.html
Exploit https://seclists.org/oss-sec/2022/q2/155
26
/ 100
low-risk
Severity 16/34 · Moderate
Exploitability 0/34 · Minimal
Exposure 10/34 · Low