CVE-2022-33743

HIGH

Linux Kernel 5.9-5.17 - Use-After-Free in Network Backend SKB Handling

Title source: llm

Description

network backend may cause Linux netfront to use freed SKBs While adding logic to support XDP (eXpress Data Path), a code label was moved in a way allowing for SKBs having references (pointers) retained for further processing to nevertheless be freed.

References (4)

Core 4

Core References

Vendor Advisory x_refsource_misc

https://xenbits.xenproject.org/xsa/advisory-405.txt

Patch, Vendor Advisory x_refsource_confirm

http://xenbits.xen.org/xsa/advisory-405.html

Mailing List, Patch, Third Party Advisory mailing-list x_refsource_mlist

http://www.openwall.com/lists/oss-security/2022/07/05/5

Third Party Advisory vendor-advisory x_refsource_debian

https://www.debian.org/security/2022/dsa-5191

Scores

CVSS v3 7.8

EPSS 0.0011

EPSS Percentile 28.7%

Attack Vector LOCAL

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Details

Status published

Products (3)

debian/debian_linux 11.0

linux/linux_kernel 5.9 - 5.18

xen/xen

Published Jul 05, 2022

Tracked Since Feb 18, 2026