CVE-2022-2959 is a race condition vulnerability in the Linux kernel's watch queue, specifically within the pipe_resize_ring() function, affecting Linux kernel versions. This flaw allows a local user to crash the system or escalate privileges due to improper locking during pipe buffer operations. With a CVSS score of 7.0 (HIGH), it requires local access and has high impact on confidentiality, integrity, and availability, but with high attack complexity. There is currently no public exploit code available (Metasploit, Nuclei, ExploitDB), it is not listed on the KEV catalog, and has received no community discussion or media coverage.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
>= 5.8, < 5.10.120CPE matchmatch criteria | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | ||
>= 5.11, < 5.15.45CPE matchmatch criteria | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | ||
>= 5.16, < 5.17.13CPE matchmatch criteria | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | ||
>= 5.18, < 5.18.2CPE matchmatch criteria | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.2 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.4 InfoSec Media, 0.1 Vendor Blog, and 0.0 Security Researcher mentions.
A race condition was found in the Linux kernel's watch queue due to a missing lock in pipe_resize_ring(). The specific flaw exists within the handling of pipe buffers. The issue results from the lack of proper locking when performing operations on an object. This flaw allows a local user to crash the system or escalate their privileges on the system.
Aug 9, 2022kernel: watch queue race condition can lead to privilege escalation
May 27, 2022