vulnerability
Oracle Linux: CVE-2022-21499: ELSA-2022-9926: Unbreakable Enterprise kernel security update (IMPORTANT) (Multiple Advisories)
Severity | CVSS | Published | Added | Modified |
---|---|---|---|---|
6 | (AV:L/AC:L/Au:M/C:C/I:C/A:C) | May 24, 2022 | May 25, 2022 | Jan 23, 2025 |
Severity
6
CVSS
(AV:L/AC:L/Au:M/C:C/I:C/A:C)
Published
May 24, 2022
Added
May 25, 2022
Modified
Jan 23, 2025
Description
KGDB and KDB allow read and write access to kernel memory, and thus should be restricted during lockdown. An attacker with access to a serial port could trigger the debugger so it is important that the debugger respect the lockdown mode when/if it is triggered. CVSS 3.1 Base Score 6.7 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).
A flaw was found in the kernel/debug/debug_core.c in the Linux kernel in lockdown mode. This flaw allows an attacker with local access to trigger the debugger, bypass lockdown and write anonymously.
A flaw was found in the kernel/debug/debug_core.c in the Linux kernel in lockdown mode. This flaw allows an attacker with local access to trigger the debugger, bypass lockdown and write anonymously.
Solution(s)
oracle-linux-upgrade-kerneloracle-linux-upgrade-kernel-uek
References
- CVE-2022-21499
- https://attackerkb.com/topics/CVE-2022-21499
- ELSA-ELSA-2022-9926
- ELSA-ELSA-2022-9426
- ELSA-ELSA-2022-9422
- ELSA-ELSA-2022-9871
- ELSA-ELSA-2022-9423
- ELSA-ELSA-2022-9427
- ELSA-ELSA-2022-8267
- ELSA-ELSA-2022-9425
- ELSA-ELSA-2022-5232
- ELSA-ELSA-2022-9927
- ELSA-ELSA-2022-9870
- ELSA-ELSA-2022-9496
- ELSA-ELSA-2022-9495
- ELSA-ELSA-2022-7683

NEW
Explore Exposure Command
Confidently identify and prioritize exposures from endpoint to cloud with full attack surface visibility and threat-aware risk context.