CVE-2022-2977

HIGH

Linux Kernel 4.12-4.14.276 - Use-After-Free in Proxied Virtualized TPM Device

Title source: llm
STIX 2.1

Description

A flaw was found in the Linux kernel implementation of proxied virtualized TPM devices. On a system where virtualized TPM devices are configured (this is not the default) a local attacker can create a use-after-free and create a situation where it may be possible to escalate privileges on the system.

References (2)

Core 2

Scores

CVSS v3 7.8
EPSS 0.0023
EPSS Percentile 14.1%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Details

CWE
CWE-416
Status published
Products (1)
linux/linux_kernel 4.12 - 4.14.276
Published Sep 14, 2022
Tracked Since Feb 18, 2026