Use of Uninitialized Resource Affecting kernel-default-base package, versions <5.3.18-150200.24.134.1.150200.9.63.2


Severity

Recommended
0.0
medium
0
10

Based on SUSE Linux Enterprise Server security rating.

Threat Intelligence

EPSS
0.05% (18th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-SLES152-KERNELDEFAULTBASE-3061205
  • published25 Oct 2022
  • disclosed24 Oct 2022

Introduced: 24 Oct 2022

CVE-2022-20008  (opens in a new tab)
CWE-908  (opens in a new tab)

How to fix?

Upgrade SLES:15.2 kernel-default-base to version 5.3.18-150200.24.134.1.150200.9.63.2 or higher.

NVD Description

Note: Versions mentioned in the description apply only to the upstream kernel-default-base package and not the kernel-default-base package as distributed by SLES. See How to fix? for SLES:15.2 relevant fixed versions and status.

In mmc_blk_read_single of block.c, there is a possible way to read kernel heap memory due to uninitialized data. This could lead to local information disclosure if reading from an SD card that triggers errors, with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-216481035References: Upstream kernel

CVSS Scores

version 3.1