CVE-2022-2991 is a heap-based buffer overflow in the Linux kernel's LightNVM subsystem, affecting Linux kernel versions. This vulnerability allows a local attacker with high privileges to escalate privileges and execute arbitrary code within the kernel. While rated Medium severity (CVSS 6.7), its exploitability requires prior high-privileged access. There is no public exploit code available, and it has not been observed in active exploitation, nor has it garnered significant community discussion or media coverage.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 5.15CPE matchmatch criteria | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.0 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
A heap-based buffer overflow was found in the Linux kernel's LightNVM subsystem. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length heap-based buffer. This vulnerability allows a local attacker to escalate privileges and execute arbitrary code in the context of the kernel. The attacker must first obtain the ability to execute high-privileged code on the target system to exploit this vulnerability.
Aug 9, 2022kernel: heap-based overflow in LightNVM Subsystem may lead to privilege escalation
Jul 11, 2022