What’s Vulnerable › Vulnerabilities
CVE-2022-1011
- Severity: high (CVSS 7.8 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 1.2% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2022-03-18 · updated 2026-08-26
- Weakness: CWE-416
Description
A use-after-free flaw was found in the Linux kernel’s FUSE filesystem in the way a user triggers write(). This flaw allows a local user to gain unauthorized access to data from the FUSE filesystem, resulting in privilege escalation.
Affected products
- Debian Linux: 9.0, 10.0
- Fedoraproject Fedora: 34, 35
- Linux kernel: from 2.6.35 before 4.9.320; from 4.10 before 4.14.276; from 4.15 before 4.19.238; from 4.20 before 5.4.185; from 5.5 before 5.10.106; from 5.11 before 5.15.29 — fixed in 4.14.276, 4.19.238, 4.9.320, 5.10.106, 5.15.29, 5.16.15
- NetApp H300E Firmware: all versions
- NetApp H300S Firmware: all versions
- NetApp H410C Firmware: all versions
- NetApp H410S Firmware: all versions
- NetApp H500E Firmware: all versions
- NetApp H500S Firmware: all versions
- NetApp H700E Firmware: all versions
- NetApp H700S Firmware: all versions
- Oracle Communications Cloud Native Core Binding Support Function: 22.1.3
- Red Hat build of Quarkus: 2.0
- RedHat Codeready Linux Builder: all versions
- RedHat Developer Tools: 1.0
- Red Hat Enterprise Linux: 6.0, 7.0, 8.0
- RedHat Enterprise Linux Eus: 8.6
- RedHat Enterprise Linux For Ibm Z Systems: 8.0
- RedHat Enterprise Linux For Ibm Z Systems Eus: 8.6
- RedHat Enterprise Linux For Power Little Endian: 8.0
- RedHat Enterprise Linux For Power Little Endian Eus: 8.6
- RedHat Enterprise Linux For Real Time: 8
- RedHat Enterprise Linux For Real Time For Nfv: 8
- RedHat Enterprise Linux For Real Time For Nfv Tus: 8.6
- RedHat Enterprise Linux For Real Time Tus: 8.6
- RedHat Enterprise Linux Server Aus: 8.6
- RedHat Enterprise Linux Server For Power Little Endian Update Services For Sap Solutions: 8.6
- RedHat Enterprise Linux Server Tus: 8.6
- RedHat Enterprise Linux Server Update Services For Sap Solutions: 8.6
- RedHat Virtualization Host: 4.0
How to fix
Upgrade to a fixed version: Linux kernel 4.14.276, 4.19.238, 4.9.320, 5.10.106. Check the vendor advisory for mitigations.
References
- https://bugzilla.redhat.com/show_bug.cgi?id=2064855
- https://git.kernel.org/pub/scm/linux/kernel/git/mszeredi/fuse.git/commit/?h=for-next
- https://lists.debian.org/debian-lts-announce/2022/07/msg00000.html
- https://www.debian.org/security/2022/dsa-5173
- https://www.oracle.com/security-alerts/cpujul2022.html
- https://bugzilla.redhat.com/show_bug.cgi?id=2064855
- https://git.kernel.org/pub/scm/linux/kernel/git/mszeredi/fuse.git/commit/?h=for-next
- https://lists.debian.org/debian-lts-announce/2022/07/msg00000.html
- https://www.debian.org/security/2022/dsa-5173
- https://www.oracle.com/security-alerts/cpujul2022.html
Get alerted when CVE-2022-1011 or the next vulnerability affects your stack