CVE-2022-0322

MediumCVSS 5.5/10Last modified Jun 17, 2026

Description

A flaw was found in the sctp_make_strreset_req function in net/sctp/sm_make_chunk.c in the SCTP network protocol in the Linux kernel with a local user privilege access. In this flaw, an attempt to use more buffer than is allocated triggers a BUG_ON issue, leading to a denial of service (DOS).

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-681 CWE-704

Affected software

Vendor	Product	Versions
n/a	kernel	kernel 5.15 rc6

References

https://bugzilla.redhat.com/show_bug.cgi?id=2042822Issue Tracking, Third Party Advisory
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=a2d859e3fc97e79d907761550dbc03ff1b36479cPatch, Vendor Advisory
https://www.oracle.com/security-alerts/cpujul2022.htmlPatch, Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2042822Issue Tracking, Third Party Advisory
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=a2d859e3fc97e79d907761550dbc03ff1b36479cPatch, Vendor Advisory
https://www.oracle.com/security-alerts/cpujul2022.htmlPatch, Third Party Advisory

Timeline

Published: Mar 25, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-03238.8Improper Neutralization of Special Elements Used in a Template Engine in Packagist mustache/mustache prior to 2.14.1.CVE-2022-03247.5There is a vulnerability in DHCPv6 packet parsing code that could be explored by remote attacker to craft a packet that could cause buffer o CVE-2022-03265.5NULL Pointer Dereference in Homebrew mruby prior to 3.2.CVE-2022-03276.1The Master Addons for Elementor WordPress plugin before 1.8.5 does not sanitise and escape the error_message parameter before outputting it CVE-2022-03284.7The Simple Membership WordPress plugin before 4.0.9 does not have CSRF check when deleting members in bulk, which could allow attackers to m CVE-2022-03307.8A random memory access flaw was found in the Linux kernel's GPU i915 kernel driver functionality in the way a user may run malicious code on CVE-2022-03315.3An information disclosure vulnerability in Webadmin allows an unauthenticated remote attacker to read the device serial number in Sophos Fir CVE-2022-03329.8A flaw was found in Moodle in versions 3.11 to 3.11.4. An SQL injection risk was identified in the h5p activity web service responsible for CVE-2022-03333.8A flaw was found in Moodle in versions 3.11 to 3.11.4, 3.10 to 3.10.8, 3.9 to 3.9.11 and earlier unsupported versions. The calendar:manageen CVE-2022-03344.3A flaw was found in Moodle in versions 3.11 to 3.11.4, 3.10 to 3.10.8, 3.9 to 3.9.11 and earlier unsupported versions. Insufficient capabili CVE-2022-03358.8A flaw was found in Moodle in versions 3.11 to 3.11.4, 3.10 to 3.10.8, 3.9 to 3.9.11 and earlier unsupported versions. The "delete badge ali CVE-2022-03368.8The Samba AD DC includes checks when adding service principals names (SPNs) to an account to ensure that SPNs do not alias with those alread