A flaw in the Linux kernel was found in the vhost driver allowing the bypassing of group-based security checks. A host local user can use this flaw to escalate their privileges on the system. The problem was actually introduced from Linux Kernel 4.13. The issue was discovered by Eric Rescorla of Red Hat. The issue affects the following Linux operating systems: Red Hat Enterprise Linux 7 Red Hat Enterprise Linux 6 Debian 9 Fedora Linux Red Hat Enterprise Linux 5 SuSE Linux (up to version 2019) Ubuntu Linux (up to version 2019) The issue affects the following devices: Intel® 82579LM and 82580 gigabit network adapters Intel® Ethernet Converged Network Adapter Intel® 10 Gigabit PCI Express Adapter Intel® X552 PCI Express adapter The issue affects the following kernel versions: Red Hat Enterprise Linux 7: 4.13* Red Hat Enterprise Linux 6: 4.9* Debian 9: 4.9.0-3.1 SuSE Linux: 4.11.12* Ubuntu Linux: 18.04* The issue has been fixed in the following kernel versions: Red Hat Enterprise Linux 7: 5.0.9-300 Red Hat Enterprise Linux 6: 5.0.9-300 Debian 9: 5.0.9-300 SuSE Linux: 5.0.9-300 Ubuntu Linux: 18.04 5.0.9-300 **************** Red Hat Enterprise Linux 7: 5.11.11-300 Red Hat Enterprise Linux
Overview of the vulnerability
A flaw in the Linux kernel was found in the vhost driver allowing the bypassing of group-based security checks. A host local user can use this flaw to escalate their privileges on the system. The problem was actually introduced from Linux Kernel 4.13. The issue was discovered by Eric Rescorla of Red Hat. The issue affects the following Linux operating systems: Red Hat Enterprise Linux 7 Red Hat Enterprise Linux 6 Debian 9 Fedora Linux Red Hat Enterprise Linux 5 SuSE Linux (up to version 2019) Ubuntu Linux (up to version 2019) The issue affects the following devices: Intel® 82579LM and 82580 gigabit network adapters Intel® Ethernet Converged Network Adapter Intel® 10 Gigabit PCI Express Adapter Intel® X552 PCI Express adapter The issue affects the following kernel versions: Red Hat Enterprise Linux 7: 4.13* Red Hat Enterprise Linux 6: 4.9* Debian 9: 4.9.0-3.1 SuSE Linux: 4.11.12* Ubuntu Linux: 18.04* **************** Red Hat Enterprise Linux 7: 5.11.*
Linux kernel vulnerabilities summary (Hexad solid)
# CVE-2022-0646
A flaw in the Linux kernel was found in the vhost driver allowing the bypassing of group-based security checks. A host local user can use this flaw to escalate their privileges on the system. The problem was actually introduced from Linux Kernel 4.13. The issue was discovered by Eric Rescorla of Red Hat. The issue affects the following Linux operating systems: Red Hat Enterprise Linux 7 Red Hat Enterprise Linux 6 Debian 9 Fedora Linux Red Hat Enterprise Linux 5 SuSE Linux (up to version 2019) Ubuntu Linux (up to version 2019) The issue affects the following devices: Intel® 82579LM and 82580 gigabit network adapters Intel® Ethernet Converged Network Adapter Intel® 10 Gigabit PCI Express Adapter Intel® X552 PCI Express adapter The issue affects the following kernel versions: Red Hat Enterprise Linux 7: 4.13* Red Hat Enterprise Linux 6: 4.9* Debian 9: 4.9.0-3.1 SuSE Linux: 4.11.12* Ubuntu Linux: 18.04* The issue has been fixed in the following kernel versions: Red Hat Enterprise Linux 7: 5.0.9-300 Red Hat Enterprise Linux 6: 5.0.9-300 Debian 9: 5.0.9-300 SuSE Linux: 5.0.9-300 UbuntuLinux 18 .04 :5 .0 . 0 - 3 1 ****************
Red Hat EnterpriseLinux
Overview of the issue
CVE-2022-0646 is a vulnerability in the Linux kernel where a host local user can use this flaw to escalate their privileges on the system. This vulnerability was introduced from Linux Kernel 4.13 and affects the following systems: Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 6, Debian 9, Fedora, SuSE Linux (up to version 2019) and Ubuntu Linux (up to version 2019). The issue affects devices including Intel 82579LM and 82580 gigabit network adapters, Intel Ethernet Converged Network Adapter and Intel 10 Gigabit PCI Express Adapter. The issue has been fixed in the following kernel versions: Red Hat Enterprise Linux 7: 5.11.11-300
Intel® Ethernet Converged Network Adapter
The vulnerability in Linux Kernel 3.18 allows a local attacker to gain elevated privileges on the system.
Timeline
Published on: 02/18/2022 18:15:00 UTC
Last modified on: 05/11/2022 13:26:00 UTC