CVE-2022-25265 Security feature bypass in n/a
The Linux kernel may incorrectly mark old binary files as executable, allowing attackers to execute code in non-executable memory regions.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-25265?
CVE-2022-25265 is a high-severity vulnerability in Linux kernel, published on 16 Feb 2022. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel through 5.16.10, certain binary files may have the exec-all attribute if they were built in approximately 2003 (e.g., with GCC 3.2.2 and Linux kernel 2.4.20). This can cause execution of bytes located in supposedly non-executable regions of a file.
Weakness: CWE-913
Which versions are affected by CVE-2022-25265?
It affects 9 products.
Products include Linux kernel, Netapp Baseboard Management Controller Firmware, Netapp H300e Firmware, Netapp H300s Firmware, Netapp H410s Firmware, Netapp H500e Firmware and 3 more.
How do I fix CVE-2022-25265?
Apply the vendor's patch.
Is CVE-2022-25265 being exploited?
There is no known exploitation of CVE-2022-25265 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Other vulnerabilities in Linux kernel
Sources
Also known as AZL-8641, DEBIAN-CVE-2022-25265, GHSA-jgc5-xgwj-77vf, ROOT-OS-DEBIAN-11-CVE-2022-25265, ROOT-OS-DEBIAN-12-CVE-2022-25265, ROOT-OS-DEBIAN-13-CVE-2022-25265 and 1 more.