CVE-2022-3595 The sess_free_buffer function of the CIFS handler can be manipulated to cause a double free.
Software version affected by this issue is 4.13. Linux kernel version 4.14 or later is recommended to be used to run the system on this software version. Red Hat and Debian based systems are some of the Linux distributions that are currently being used by many systems administrators. If you want to know if your system is using this distribution, then you can use the command uname -a.
Severity of this issue is critical. If you are using a system, which runs this software, on a critical service, then you must patch it as soon as possible. The patch can be downloaded from the vendors’ website.
It has been found that system administrators are facing another issue. On certain systems, the kernel is crashing with “soft lockup”. The crash happens when the system boots, as soon as you log in. The crash happens at the sess_free_buffer function. The crash is happening in Red Hat Enterprise Linux 7 and Debian 9. The crash happens in the x86 and ARM architectures. The crash happens on the system.
What is the Linux Kernel?
The Linux Kernel is a computer program that manages the hardware on a system. It is a key component of operating systems like Red Hat Enterprise Linux, Debian, and Ubuntu. In order to provide multiprocessing, the kernel uses virtual memory paging to share physical memory between its processes.
How to know if your system is vulnerable?
To know if your system is vulnerable, you should run the command uname -a.
If the kernel crashes with a “soft lockup”, then your system is vulnerable to this issue.
What is the software version?
The software version affected by this issue is 4.13. Linux kernel version 4.14 or later is recommended to be used to run the system on this software version.
The severity and the scope of the issue
The severity of this issue has been rated as critical. If you are using a system, which runs this software, on a critical service then you must patch it as soon as possible to avoid any data loss. The patch can be downloaded from the vendors’ website.
The scope of the issue is also wide in nature and has been reported by many users from different systems. The crash has also been reported to be happening in Red Hat Enterprise Linux 7 and Debian 9 with x86 and ARM architectures.
Timeline
Published on: 10/18/2022 20:15:00 UTC
Last modified on: 10/20/2022 15:36:00 UTC