CVE-2022-44033 is a race condition leading to a use-after-free vulnerability in the Linux kernel (through version 6.0.6), specifically within the cm4040_cs.c driver. This flaw affects Linux kernel products and can be triggered if a physically proximate attacker removes a PCMCIA device during the open() call. Rated 6.4 MEDIUM, it requires physical access (AV:P) and high attack complexity (AC:H), but could lead to high confidentiality, integrity, and availability impacts (C:H/I:H/A:H). There is no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage for this vulnerability.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
<= 6.0.6CPE matchmatch criteria | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.2 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
An issue was discovered in the Linux kernel through 6.0.6. drivers/char/pcmcia/cm4040_cs.c has a race condition and resultant use-after-free if a physically proximate attacker removes a PCMCIA device while calling open() aka a race condition between cm4040_open() and reader_detach().
Oct 11, 2022Kernel: A race condition between cm4040_open() and reader_detach() may result in UAF
Sep 18, 2022