CVE-2022-4129
Medium
Description
A flaw was found in the Linux kernel's Layer 2 Tunneling Protocol (L2TP). A missing lock when clearing sk_user_data can lead to a race condition and NULL pointer dereference. A local user could use this flaw to potentially crash the system causing a denial of service.
SeverityMedium
CVSS5.5
Exploit probability—
Product
Linux Layer 2 Tunneling Protocol
PublishedNov 28, 2022
First seenNov 28, 2022
Weakness typeCWE-667CWE-667
How to fix
Update
- linux layer_2_tunneling_protocol6.0 or later
Vendor advisories
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AM5KFIE6JNZXHBA5A2KYDZAT3MEX2B67/
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7X5SPXMXXFANDASPCKER2JIQO2F3UHCP/
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JOKXNIM2R4FQCDRQV67UMAY6EBC72QFG/
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| linux layer_2_tunneling_protocol | v < 6.0 | 6.0 |
| fedoraproject fedora | 35, 36, 37 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.