CVE-2022-21499

MediumCVSS 6.7/10Last modified Jun 17, 2026

Description

KGDB and KDB allow read and write access to kernel memory, and thus should be restricted during lockdown. An attacker with access to a serial port could trigger the debugger so it is important that the debugger respect the lockdown mode when/if it is triggered. CVSS 3.1 Base Score 6.7 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).

Metrics

CVSS 3.1 6.7/10CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-787

Affected software

Vendor	Product	Versions
Oracle Corporation	Oracle Linux	Oracle Linux: 6; Oracle Linux: 7; Oracle Linux: 8
Oracle Corporation	Oracle VM	Oracle VM: 3

References

http://packetstormsecurity.com/files/168191/Kernel-Live-Patch-Security-Notice-LSN-0089-1.htmlThird Party Advisory, VDB Entry
https://git.kernel.org/linus/eadb2f47a3ced5c64b23b90fd2a3463f63726066Mailing List, Patch, Vendor Advisory
https://www.debian.org/security/2022/dsa-5161Third Party Advisory
http://packetstormsecurity.com/files/168191/Kernel-Live-Patch-Security-Notice-LSN-0089-1.htmlThird Party Advisory, VDB Entry
https://git.kernel.org/linus/eadb2f47a3ced5c64b23b90fd2a3463f63726066Mailing List, Patch, Vendor Advisory
https://www.debian.org/security/2022/dsa-5161Third Party Advisory

Timeline

Published: Jun 9, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-215007.5Vulnerability in Oracle E-Business Suite (component: Manage Proxies). The supported version that is affected is 12.2. Easily exploitable vul CVE-2022-215034.9Vulnerability in the Oracle Cloud Infrastructure product of Oracle Cloud Services. Easily exploitable vulnerability allows high privileged a CVE-2022-215045.5The code in UEK6 U3 was missing an appropiate file descriptor count to be missing. This resulted in a use count error that allowed a file de CVE-2022-215056.7In the linux kernel, if IMA appraisal is used with the "ima_appraise=log" boot param, lockdown can be defeated with kexec on any machine whe CVE-2022-215085.8Vulnerability in Oracle Essbase (component: Security and Provisioning). The supported version that is affected is 21.3. Easily exploitable v CVE-2022-215095.5Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.29 an CVE-2022-21514.8The Best Contact Management Software WordPress plugin through 3.7.3 does not sanitise and escape its settings, allowing high privilege users CVE-2022-215108.8Vulnerability in the Oracle Database - Enterprise Edition Sharding component of Oracle Database Server. For supported versions that are affe CVE-2022-215117.2Vulnerability in the Oracle Database - Enterprise Edition Recovery component of Oracle Database Server. For supported versions that are affe CVE-2022-215124.4Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Integration Broker). Supported versions that CVE-2022-215138.2Vulnerability in the Oracle ZFS Storage Appliance Kit product of Oracle Systems (component: Core). The supported version that is affected is CVE-2022-215147.5Vulnerability in the Oracle Solaris product of Oracle Systems (component: Remote Administration Daemon). The supported version that is affec