Vulnerability · NVD

CVE-2022-4696

CVE-2022-4696 : high severity (CVSS 7.8). No tracked catalog app is linked to this CVE.

Severity (CVSS): 7.8
Exploitation: 0.4 %
Tracked apps: 0
Still exposed: 0

Published on 2023-01-11

There exists a use-after-free vulnerability in the Linux kernel through io_uring and the IORING_OP_SPLICE operation. If IORING_OP_SPLICE is missing the IO_WQ_WORK_FILES flag, which signals that the operation won't use current->nsproxy, so its reference counter is not increased. This assumption is not always true as calling io_splice on specific files will call the get_uts function which will use current->nsproxy leading to invalidly decreasing its reference counter later causing the use-after-free vulnerability. We recommend upgrading to version 5.10.160 or above

Attack vector : Local No user interaction

Show raw CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS 0.43% exploit very unlikely percentile 34.8%

OS versions that fix this CVE

This CVE is resolved by the following OS security releases. Update the OS to at least the listed version.

Android Fixed in April 2023 patch level

View on NVD ↗ Advisory · git.kernel.org Advisory · security.netapp.com

Manage your fleet with Appaloosa

Appaloosa pushes OS updates, apps and policies to your Windows, macOS, iOS and Android devices from one console.

Discover Appaloosa MDM