What’s Vulnerable › Vulnerabilities
CVE-2022-0435
- Severity: high (CVSS 8.8 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 67.8% probability of exploitation in the next 30 days
- Public exploit or detection template: yes
- Published: 2022-03-25 · updated 2026-06-17
- Weakness: CWE-787
Description
A stack overflow flaw was found in the Linux kernel's TIPC protocol functionality in the way a user sends a packet with malicious content where the number of domain member nodes is higher than the 64 allowed. This flaw allows a remote user to crash the system or possibly escalate their privileges if they have access to the TIPC network.
Affected products
- Fedoraproject Fedora: 34, 35
- Linux kernel: from 4.8 before 4.9.301; from 4.10 before 4.14.266; from 4.15 before 4.19.229; from 4.20 before 5.4.179; from 5.5 before 5.10.100; from 5.11 before 5.15.23 — fixed in 4.14.266, 4.19.229, 4.9.301, 5.10.100, 5.15.23, 5.16.9
- NetApp H300E Firmware: all versions
- NetApp H300S Firmware: all versions
- NetApp H410S Firmware: all versions
- NetApp H500E Firmware: all versions
- NetApp H500S Firmware: all versions
- NetApp H700E Firmware: all versions
- NetApp H700S Firmware: all versions
- oVirt Node: 4.4.10
- RedHat Codeready Linux Builder: 8.0, 8.4
- RedHat Codeready Linux Builder Eus: 8.2
- RedHat Codeready Linux Builder Eus For Power Little Endian: 8.2
- RedHat Codeready Linux Builder For Power Little Endian Eus: 8.0, 8.4
- Red Hat Enterprise Linux: 8.0
- RedHat Enterprise Linux Eus: 8.2, 8.4
- RedHat Enterprise Linux For Ibm Z Systems: 8.0
- RedHat Enterprise Linux For Ibm Z Systems Eus: 8.2, 8.4
- RedHat Enterprise Linux For Power Little Endian: 8.0
- RedHat Enterprise Linux For Power Little Endian Eus: 8.2, 8.4
- RedHat Enterprise Linux For Real Time: 8
- RedHat Enterprise Linux For Real Time For Nfv: 8
- RedHat Enterprise Linux For Real Time For Nfv Tus: 8.2, 8.4
- RedHat Enterprise Linux For Real Time Tus: 8.2, 8.4
- RedHat Enterprise Linux Server Aus: 8.2, 8.4
- RedHat Enterprise Linux Server For Power Little Endian Update Services For Sap Solutions: 8.2, 8.4
- RedHat Enterprise Linux Server Tus: 8.2, 8.4
- RedHat Enterprise Linux Server Update Services For Sap Solutions: 8.2, 8.4
- RedHat Virtualization: 4.0
- RedHat Virtualization Host: 4.0
How to fix
Upgrade to a fixed version: Linux kernel 4.14.266, 4.19.229, 4.9.301, 5.10.100. Check the vendor advisory for mitigations.
References
- https://bugzilla.redhat.com/show_bug.cgi?id=2048738
- https://security.netapp.com/advisory/ntap-20220602-0001/
- https://www.openwall.com/lists/oss-security/2022/02/10/1
- https://bugzilla.redhat.com/show_bug.cgi?id=2048738
- https://security.netapp.com/advisory/ntap-20220602-0001/
- https://www.openwall.com/lists/oss-security/2022/02/10/1
Get alerted when CVE-2022-0435 or the next vulnerability affects your stack