CVE-2022-0433 is a NULL pointer dereference vulnerability in the Linux kernel's BPF subsystem, specifically affecting the map_get_next_key function of the BPF bloom filter. This flaw impacts Linux kernel versions prior to 5.17-rc1, including Fedora and other Linux distributions utilizing these kernels. Rated as Medium severity (CVSS 5.5), this vulnerability allows a local attacker to crash the system, leading to a denial of service. The attack requires local access and has low attack complexity, with no user interaction needed. Currently, there is no evidence of active exploitation, nor are there publicly available exploit modules for Metasploit, Nuclei, or ExploitDB. The vulnerability has received minimal community discussion and media coverage, indicating low public attention.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
<= 5.16CPE matchmatch criteria | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | ||
35CPE matchmatch criteria | cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.0 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
A NULL pointer dereference flaw was found in the Linux kernel's BPF subsystem in the way a user triggers the map_get_next_key function of the BPF bloom filter. This flaw allows a local user to crash the system. This flaw affects Linux kernel versions prior to 5.17-rc1.
Mar 8, 2022kernel: missing initialization in bloom filter map in kernel/bpf/bloom_filter.c can lead to DoS
Jan 10, 2022