CVE-2022-0382 is an information leak vulnerability in the Linux kernel's TIPC protocol subsystem, affecting versions prior to 5.17-rc1. A local attacker can exploit this flaw to read up to 7 bytes of uninitialized kernel memory. Rated as Medium severity (CVSS 5.5), the attack requires local access and provides no control over the read data, limiting its impact to confidentiality. There is no evidence of active exploitation, public exploit code, or significant community discussion surrounding this vulnerability.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
<= 5.16.10CPE matchmatch criteria | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.0 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
An information leak flaw was found due to uninitialized memory in the Linux kernel's TIPC protocol subsystem in the way a user sends a TIPC datagram to one or more destinations. This flaw allows a local user to read some kernel memory. This issue is limited to no more than 7 bytes and the user cannot control what is read. This flaw affects the Linux kernel versions prior to 5.17-rc1.
Feb 8, 2022kernel: information leak due to uninitialized memory in __tipc_sendmsg() in net/tipc/socket.c
Dec 26, 2021