CVE-2022-21505
MEDIUM
6,7
Source: [email protected]
Attack Vector: local
Attack Complexity: low
Privileges Required: high
User Interaction: none
Scope: unchanged
Confidentiality: high
Integrity: high
Availability: high
Description
AI Translation Available
In the linux kernel, if IMA appraisal is used with the 'ima_appraise=log' boot param, lockdown can be defeated with kexec on any machine when Secure Boot is disabled or unavailable. IMA prevents setting 'ima_appraise=log' from the boot param when Secure Boot is enabled, but this does not cover cases where lockdown is used without Secure Boot. CVSS 3.1 Base Score 6.7 (Confidentiality, Integrity, Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).
EPSS (Exploit Prediction Scoring System)
Trend Analysis
EPSS (Exploit Prediction Scoring System)
Prevede la probabilità di sfruttamento basata su intelligence sulle minacce e sulle caratteristiche della vulnerabilità.
EPSS Score
0,0005
Percentile
0,2th
Updated
EPSS Score Trend (Last 90 Days)
346
Origin Validation Error
DraftCommon Consequences
Security Scopes Affected:
Other
Access Control
Potential Impacts:
Gain Privileges Or Assume Identity
Varies By Context
Applicable Platforms
Technologies:
Not Technology-Specific, Web Based
Operating System
Linux by Oracle
CPE Identifier
View Detailed Analysis
cpe:2.3:o:oracle:linux:7:-:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Operating System
Linux by Oracle
CPE Identifier
View Detailed Analysis
cpe:2.3:o:oracle:linux:9:-:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Operating System
Linux by Oracle
CPE Identifier
View Detailed Analysis
cpe:2.3:o:oracle:linux:8:-:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
https://git.kernel.org/linus/543ce63b664e2c2f9533d089a4664b559c3e6b5b
https://linux.oracle.com/cve/CVE-2022-21505.html