CVE-2022-33743 describes a use-after-free vulnerability in the Linux kernel's network backend, specifically affecting Debian and Xen environments. This flaw, introduced during XDP support implementation, allows SKBs (socket kernel buffers) to be prematurely freed while still referenced, potentially leading to system instability or crashes. With a CVSS score of 7.8 (HIGH), this vulnerability has a local attack vector, low complexity, and could result in high impact to confidentiality, integrity, and availability. Currently, there is no evidence of active exploitation, public exploit code, or significant community discussion, and it is not listed in CISA's KEV catalog.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
>= 5.9, <= 5.18CPE matchmatch criteria | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | ||
Range not provided by sourceCPE matchmatch criteria | cpe:2.3:o:xen:xen:-:*:*:*:*:*:*:* | ||
11.0CPE matchmatch criteria | cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.2 Bluesky, 0.1 Mastodon, and 0.2 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
network backend may cause Linux netfront to use freed SKBs While adding logic to support XDP (eXpress Data Path) a code label was moved in a way allowing for SKBs having references (pointers) retained for further processing to nevertheless be freed.
Jul 12, 2022kernel: network backend may cause Linux netfront to use freed SKBs (XSA-405)
Jul 4, 2022