What is CVE-2022-1998?

CVE-2022-1998 is a high-severity vulnerability in the Linux kernel File System notify functionality. This use-after-free bug can be exploited by a local user to crash the system or potentially escalate their privileges. Systems running certain Linux kernel versions, as well as specific Fedora, Red Hat Enterprise Linux, and NetApp firmware configurations, are vulnerable. This flaw poses significant security risks, especially for users unfamiliar with technical details.

Who is impacted by this?

CVE-2022-1998 affects users running specific Linux kernel versions, Fedora 35, Red Hat Enterprise Linux 9.0, and certain NetApp firmware configurations. Impacted Linux kernel versions include 5.10.46 to 5.10.97, 5.12.12 to 5.15.20, and 5.16.0 to 5.16.6. NetApp H300s, H410c, H410s, H500s, and H700s firmware users are also affected. This vulnerability can lead to system crashes or privilege escalation for local users, posing significant security risks.

What to do if CVE-2022-1998 affected you

If you're affected by the CVE-2022-1998 vulnerability, it's important to take action to protect your system. Follow these steps:

1. Check if your system is running an affected Linux kernel version, Fedora 35, Red Hat Enterprise Linux 9.0, or specific NetApp firmware configurations.

2. Monitor updates from the NVD, oss-sec, and NetApp for patches and fixes.

3. Apply the patches provided by the respective developers once they become available.

4. Contact your system vendor or technical support for assistance if needed.

Is this n CISA’s Known Exploited Vulnerabilities Catalog?

CVE-2022-1998, a Linux kernel vulnerability, is not listed in CISA's Known Exploited Vulnerabilities Catalog. The vulnerability was published on June 9, 2022.

Weakness Enumeration

The weakness enumeration for this vulnerability is categorized as CWE-416, a use-after-free issue in the Linux kernel File System notify functionality.

Learn More

For a comprehensive understanding of this vulnerability, including its description, severity, technical details, and affected software configurations, refer to the NVD page or the sources listed below.

• NVD - CVE-2022-1998

• oss-sec: Linux kernel: erroneous error handling after fd_install)

• CVE-2022-1998 Linux Kernel Vulnerability in NetApp Products | NetApp Product Security