SecuriTricks - CVE-2022-21505

Description

In the linux kernel, if IMA appraisal is used with the "ima_appraise=log" boot param, lockdown can be defeated with kexec on any machine when Secure Boot is disabled or unavailable. IMA prevents setting "ima_appraise=log" from the boot param when Secure Boot is enabled, but this does not cover cases where lockdown is used without Secure Boot. CVSS 3.1 Base Score 6.7 (Confidentiality, Integrity, Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).

Product(s) Impacted

Product	Versions
Linux Kernel	[]

Weaknesses

Common security weaknesses mapped to this vulnerability.

CWE-346

Origin Validation Error

The product does not properly verify that the source of data or communication is valid.

References

https://git.kernel.org/linus/543ce63b664e2c2f9533d089a4664b559c3e6b5b

https://linux.oracle.com/cve/CVE-2022-21505.html

CVSS Score

6.7 / 10

CVSS Data - 3.1

Attack Vector: LOCAL
Attack Complexity: LOW
Privileges Required: HIGH
Scope: UNCHANGED
Confidentiality Impact: HIGH
Integrity Impact: HIGH
Availability Impact: HIGH

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

View Vector String

Timeline

Published: Dec. 24, 2024, 7:15 p.m.
Last Modified: Dec. 27, 2024, 5:15 p.m.

Status : Awaiting Analysis

CVE has been recently published to the CVE List and has been received by the NVD.

More info

Source

secalert_us@oracle.com

CVE-2022-21505