What’s Vulnerable › Vulnerabilities

CVE-2022-1734

• Severity: high (CVSS 7.0 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2022-05-18 · updated 2026-08-26
• Weakness: CWE-416

Description

A flaw in Linux Kernel found in nfcmrvl_nci_unregister_dev() in drivers/nfc/nfcmrvl/main.c can lead to use after free both read or write when non synchronized between cleanup routine and firmware download routine.

Affected products

• Debian Linux: 9.0, 10.0
• Linux kernel: from 4.4 before 4.9.313; from 4.10 before 4.14.278; from 4.15 before 4.19.242; from 4.20 before 5.4.193; from 5.5 before 5.10.115; from 5.11 before 5.15.39 — fixed in 4.14.278, 4.19.242, 4.9.313, 5.10.115, 5.15.39, 5.17.7
• NetApp H300E Firmware: all versions
• NetApp H300S Firmware: all versions
• NetApp H410C Firmware: all versions
• NetApp H410S Firmware: all versions
• NetApp H500E Firmware: all versions
• NetApp H500S Firmware: all versions
• NetApp H700E Firmware: all versions
• NetApp H700S Firmware: all versions

How to fix

Upgrade to a fixed version: Linux kernel 4.14.278, 4.19.242, 4.9.313, 5.10.115. Check the vendor advisory for mitigations.

References

• http://www.openwall.com/lists/oss-security/2022/06/05/4
• http://www.openwall.com/lists/oss-security/2022/06/09/1
• https://github.com/torvalds/linux/commit/d270453a0d9ec10bb8a802a142fb1b3601a83098
• https://lists.debian.org/debian-lts-announce/2022/07/msg00000.html
• https://security.netapp.com/advisory/ntap-20220707-0007/
• https://www.debian.org/security/2022/dsa-5173
• http://www.openwall.com/lists/oss-security/2022/06/05/4
• http://www.openwall.com/lists/oss-security/2022/06/09/1
• https://github.com/torvalds/linux/commit/d270453a0d9ec10bb8a802a142fb1b3601a83098
• https://lists.debian.org/debian-lts-announce/2022/07/msg00000.html
• https://security.netapp.com/advisory/ntap-20220707-0007/
• https://www.debian.org/security/2022/dsa-5173

Get alerted when CVE-2022-1734 or the next vulnerability affects your stack