CVE-2022-0264 is a medium-severity vulnerability affecting the Linux kernel's eBPF verifier in versions prior to v5.16-rc6. It allows a local attacker with eBPF code insertion permissions to leak internal kernel memory details, thereby bypassing exploit mitigations. The vulnerability has a CVSS score of 5.5, indicating a local attack vector with low complexity and high confidentiality impact. Currently, there is no evidence of active exploitation, public exploit code, or significant community discussion surrounding this CVE.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 5.16CPE matchmatch criteria | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | ||
5.16CPE matchmatch criteria | cpe:2.3:o:linux:linux_kernel:5.16:-:*:*:*:*:*:* | ||
5.16CPE matchmatch criteria | cpe:2.3:o:linux:linux_kernel:5.16:rc1:*:*:*:*:*:* | ||
5.16CPE matchmatch criteria | cpe:2.3:o:linux:linux_kernel:5.16:rc2:*:*:*:*:*:* | ||
5.16CPE matchmatch criteria | cpe:2.3:o:linux:linux_kernel:5.16:rc3:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.0 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
A vulnerability was found in the Linux kernel's eBPF verifier when handling internal data structures. Internal memory locations could be returned to userspace. A local attacker with the permissions to insert eBPF code to the kernel can use this to leak internal kernel memory details defeating some of the exploit mitigations in place for the kernel. This flaws affects kernel versions < v5.16-rc6
Feb 8, 2022kernel: address leakage in BPF atomic fetch
Dec 14, 2021