CVE-2022-3107 is a null pointer dereference vulnerability affecting the Linux kernel through version 5.16-rc6, specifically within the netvsc_get_ethtool_stats function in drivers/net/hyperv/netvsc_drv.c due to a missing return value check for kvmalloc_array(). This medium-severity vulnerability (CVSS 5.5) can lead to a denial of service (availability impact) and requires local access with low privileges to exploit. There is currently no public exploit code available, no evidence of active exploitation, and minimal community discussion or media coverage surrounding this CVE.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 5.16.0CPE matchmatch criteria | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | ||
5.16.0CPE matchmatch criteria | cpe:2.3:o:linux:linux_kernel:5.16.0:-:*:*:*:*:*:* | ||
5.16.0CPE matchmatch criteria | cpe:2.3:o:linux:linux_kernel:5.16.0:rc1:*:*:*:*:*:* | ||
5.16.0CPE matchmatch criteria | cpe:2.3:o:linux:linux_kernel:5.16.0:rc2:*:*:*:*:*:* | ||
5.16.0CPE matchmatch criteria | cpe:2.3:o:linux:linux_kernel:5.16.0:rc3:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.0 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
An issue was discovered in the Linux kernel through 5.16-rc6. netvsc_get_ethtool_stats in drivers/net/hyperv/netvsc_drv.c lacks check of the return value of kvmalloc_array() and will cause the null pointer dereference.
Dec 13, 2022kernel: hv_netvsc: NULL pointer dereference in netvsc_get_ethtool_stats()
Dec 13, 2022