CVE-2022-21499

6.7MEDIUM

Key Information:

Vendor
Oracle
Status
Oracle Linux
Oracle Vm
Vendor
CVE Published:
9 June 2022

Summary

KGDB and KDB allow read and write access to kernel memory, and thus should be restricted during lockdown. An attacker with access to a serial port could trigger the debugger so it is important that the debugger respect the lockdown mode when/if it is triggered. CVSS 3.1 Base Score 6.7 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).

Affected Version(s)

Oracle Linux Oracle Linux: 6

Oracle Linux Oracle Linux: 7

Oracle Linux Oracle Linux: 8

References

https://git.kernel.org/linus/eadb2f47a3ced5c64b23b90fd2a3...
x_refsource_MISC
https://www.debian.org/security/2022/dsa-5161
vendor-advisoryx_refsource_DEBIAN
http://packetstormsecurity.com/files/168191/Kernel-Live-P...
x_refsource_MISC

CVSS V3.1

Score:
6.7
Severity:
MEDIUM
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Collectors

NVD DatabaseMitre Database
.