CVE-2022-0998 — HIGH (7.8) — White Hats Nepal

Q: How severe is CVE-2022-0998?

CVE-2022-0998 has been rated HIGH with a CVSS base score of 7.8/10. Review the CVSS metrics above for detailed severity breakdown.

Q: Is there a patch for CVE-2022-0998?

Check the references section above for vendor advisories and patch information. Affected products include: Linux Linux Kernel, Netapp H300S Firmware, Netapp H300S, Netapp H500S Firmware, Netapp H500S.

Vulnerability Description

An integer overflow flaw was found in the Linux kernel’s virtio device driver code in the way a user triggers the vhost_vdpa_config_validate function. This flaw allows a local user to crash or potentially escalate their privileges on the system.

CVSS Score

7.8

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality

HIGH

Integrity

HIGH

Availability

HIGH

Affected Products

Vendor	Product	Versions
Linux	Linux Kernel	>= 5.7, < 5.10.88
Netapp	H300S Firmware	-
Netapp	H300S	-
Netapp	H500S Firmware	-
Netapp	H500S	-
Netapp	H700S Firmware	-
Netapp	H700S	-
Netapp	H300E Firmware	-
Netapp	H300E	-
Netapp	H500E Firmware	-
Netapp	H500E	-
Netapp	H700E Firmware	-
Netapp	H700E	-
Netapp	H410S Firmware	-
Netapp	H410S	-
Netapp	H410C Firmware	-
Netapp	H410C	-

Related Weaknesses (CWE)

CWE-190

References

http://www.openwall.com/lists/oss-security/2022/04/02/1Mailing ListPatchThird Party Advisory
https://lore.kernel.org/netdev/20220123001216.2460383-13-sashal%40kernel.org/
https://security.netapp.com/advisory/ntap-20220513-0003/Third Party Advisory
http://www.openwall.com/lists/oss-security/2022/04/02/1Mailing ListPatchThird Party Advisory
https://lore.kernel.org/netdev/20220123001216.2460383-13-sashal%40kernel.org/
https://security.netapp.com/advisory/ntap-20220513-0003/Third Party Advisory

FAQ

What is CVE-2022-0998?

CVE-2022-0998 is a vulnerability with a CVSS score of 7.8 (HIGH). An integer overflow flaw was found in the Linux kernel’s virtio device driver code in the way a user triggers the vhost_vdpa_config_validate function. This flaw allows a local user to crash or potenti...

How severe is CVE-2022-0998?

CVE-2022-0998 has been rated HIGH with a CVSS base score of 7.8/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2022-0998?

Check the references section above for vendor advisories and patch information. Affected products include: Linux Linux Kernel, Netapp H300S Firmware, Netapp H300S, Netapp H500S Firmware, Netapp H500S.