CVE-2022-0322 is a denial-of-service vulnerability in the Linux kernel's SCTP network protocol, specifically affecting fedoraproject, linux, and oracle products. The flaw, residing in the sctp_make_strreset_req function, allows a local user with low privileges to trigger a BUG_ON condition by attempting to use an oversized buffer. This medium-severity vulnerability (CVSS 5.5) has a low attack complexity and can lead to a system crash. Currently, there is no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 5.15CPE matchmatch criteria | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | ||
5.15CPE matchmatch criteria | cpe:2.3:o:linux:linux_kernel:5.15:-:*:*:*:*:*:* | ||
5.15CPE matchmatch criteria | cpe:2.3:o:linux:linux_kernel:5.15:rc1:*:*:*:*:*:* | ||
5.15CPE matchmatch criteria | cpe:2.3:o:linux:linux_kernel:5.15:rc2:*:*:*:*:*:* | ||
5.15CPE matchmatch criteria | cpe:2.3:o:linux:linux_kernel:5.15:rc3:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
No social media mentions found for this CVE.
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.0 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
CVE-2022-0322
Apr 12, 2022A flaw was found in the sctp_make_strreset_req function in net/sctp/sm_make_chunk.c in the SCTP network protocol in the Linux kernel with a local user privilege access. In this flaw an attempt to use more buffer than is allocated triggers a BUG_ON issue leading to a denial of service (DOS).
Mar 8, 2022kernel: DoS in sctp_addto_chunk in net/sctp/sm_make_chunk.c
Oct 14, 2021