canonical ubuntu-linux CVE-2022-2586 in Canonical and Linux Products
Published on January 8, 2024

product logo product logo
It was discovered that a nft object or expression could reference a nft set on a different nft table, leading to a use-after-free once that table was deleted.

NVD

Known Exploited Vulnerability

This Linux Kernel Use-After-Free Vulnerability is part of CISA's list of Known Exploited Vulnerabilities. Linux Kernel contains a use-after-free vulnerability in the nft_object, allowing local attackers to escalate privileges. .

The following remediation steps are recommended / required by July 17, 2024: Apply updates per vendor instructions or discontinue use of the product if updates are unavailable.

Vulnerability Analysis

CVE-2022-2586 is exploitable with local system access, and requires small amount of user privileges. This vulnerability is considered to have a low attack complexity. It has an exploitability score of 1.8 out of four. The potential impact of an exploit of this vulnerability is considered to be very high.

What is a Dangling pointer Vulnerability?

Referencing memory after it has been freed can cause a program to crash, use unexpected values, or execute code.

CVE-2022-2586 has been classified to as a Dangling pointer vulnerability or weakness.


Products Associated with CVE-2022-2586

You can be notified by stack.watch whenever vulnerabilities like CVE-2022-2586 are published in these products:

Canonical Ubuntu Linux
 
Linux Kernel
 

What versions are vulnerable to CVE-2022-2586?