CVE-2022-1975 - kernel: sleep in atomic bug when firmware download timeout

MEDIUM

kernel: sleep in atomic bug when firmware download timeout

Published Aug 31, 2022

5.5

MEDIUM

CVSS 3.1

EPSS 0.24%

There is a sleep-in-atomic bug in /net/nfc/netlink.c that allows an attacker to crash the Linux kernel by simulating a nfc device from user-space.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

n/a

Linux kernel

n/a

Version	Status	Constraints
Linux kernel 5.18 rc6	affected	-

Product	Package	State	Advisory
Red Hat Enterprise Linux 6	kernel	Not affected	n/a
Red Hat Enterprise Linux 7	kernel	Not affected	n/a
Red Hat Enterprise Linux 7	kernel-rt	Not affected	n/a
Red Hat Enterprise Linux 8	kernel	Not affected	n/a
Red Hat Enterprise Linux 8	kernel-rt	Not affected	n/a
Red Hat Enterprise Linux 9	kernel	Not affected	n/a
Red Hat Enterprise Linux 9	kernel-rt	Not affected	n/a

Red Hat statement

There was no shipped kernel version that was seen affected by this problem. These files are not built in our source code.

Weaknesses (1)

CWE-248

Link	Providers	Tags
https://access.redhat.com/security/cve/CVE-2022-1975		Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2084435		Issue Tracking
https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-25243		Advisory
https://github.com/torvalds/linux/commit/4071bf121d59944d5cd2238de0642f3d7995a997		x_refsource_MISCPatchThird Party Advisory
https://nvd.nist.gov/vuln/detail/CVE-2022-1975
https://www.cve.org/CVERecord?id=CVE-2022-1975