CVE-2022-21499 Security feature bypass in Oracle Linux

Medium 6.7 Published 9 Jun 2022 Updated 24 Sep 2024

Attackers with serial access can bypass kernel lockdown via KGDB/KDB to read/write kernel memory, requiring patched kernels.

Exploited in the wild: Not known
Login needed: An administrator
Attackable: Local or same network only
Victim action needed: Not needed
Fix: Available

What is CVE-2022-21499?

CVE-2022-21499 is a medium-severity vulnerability in Debian Debian Linux, published on 9 Jun 2022. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

KGDB and KDB allow read and write access to kernel memory, and thus should be restricted during lockdown. An attacker with access to a serial port could trigger the debugger so it is important that the debugger respect the lockdown mode when/if it is triggered. CVSS 3.1 Base Score 6.7 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).

Weakness: CWE-787

Which versions are affected by CVE-2022-21499?

It affects 2 products.

Products include Debian Debian Linux, Oracle Linux.

How do I fix CVE-2022-21499?

Apply the vendor's patch.

Is CVE-2022-21499 being exploited?

There is no known exploitation of CVE-2022-21499 in the wild and no public exploit code.

All Debian Debian Linux vulnerabilities

Sources

Also known as DEBIAN-CVE-2022-21499, GHSA-rcmc-qxj3-63p4, UBUNTU-CVE-2022-21499.