diff --git a/cve/linux-kernel/2022/yaml/CVE-2022-23222.yaml b/cve/linux-kernel/2022/yaml/CVE-2022-23222.yaml new file mode 100644 index 0000000000000000000000000000000000000000..dec1b6bf776cee497be00474b19a3a8e174c941b --- /dev/null +++ b/cve/linux-kernel/2022/yaml/CVE-2022-23222.yaml @@ -0,0 +1,20 @@ +id: CVE-2022-23222 +source: https://github.com/tr3ee/CVE-2022-23222 +info: + name: Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 + severity: high + description: | + 由于 Linux 内核的 BPF 验证器存在一个空指针漏洞,没有对 *_OR_NULL 指针类型进行限制,允许这些类型进行指针运算。攻击者可利用该漏洞在获得低权限的情况下,构造恶意数据执行空指针引用攻击,最终获取服务器 root 权限 + scope-of-influence: + Linux kernel(>=5.8 && <=5.16) + reference: + - https://www.openwall.com/lists/oss-security/2022/06/04/3 + - https://security.netapp.com/advisory/ntap-20220217-0002/ + classification: + cvss-metrics: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H + cvss-score: 7.8 + cve-id: CVE-2022-23222 + cwe-id: CWE-476 + cnvd-id: None + kve-id: None + tags: cve2022,权限提升 \ No newline at end of file