CVE-2022-2586

Published: Jan 8, 2024Modified: Oct 14, 2026CISA KEV

7.8

Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitability: 1.8 / Impact: 5.9

Source: NVD

Description

It was discovered that a nft object or expression could reference a nft set on a different nft table, leading to a use-after-free once that table was deleted.

Affected (14)

Products: Siemens: Simatic S7 1500 Tm Mfp Firmware, Sinec Os · Linux: Linux Kernel · Canonical: Ubuntu Linux

2 products

Simatic S7 1500 Tm Mfp Firmware

1 product

1 product

Configuration A

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Siemens Simatic S7 1500 Tm Mfp Firmware	version < 1.1

Running on/with	Platform Versions
Siemens Simatic S7 1500 Tm Mfp	All versions

Configuration B

1 vulnerable · 6 platform

Vulnerable Software	Affected Versions
Siemens Sinec Os	version < 2.4

Running on/with	Platform Versions
Siemens Scalance Xch328	All versions
Siemens Scalance Xcm324	All versions
Siemens Scalance Xcm328	All versions
Siemens Scalance Xcm332	All versions
Siemens Scalance Xrh334	All versions
Siemens Scalance Xrm334	All versions

Configuration C

7 vulnerable

Vulnerable Software	Affected Versions
Linux Linux Kernel	3.16 ≤ version < 4.14.316
Linux Linux Kernel	4.15 ≤ version < 4.19.256
Linux Linux Kernel	4.20 ≤ version < 5.4.211
Linux Linux Kernel	5.11 ≤ version < 5.15.61
Linux Linux Kernel	5.16 ≤ version < 5.18.18
Linux Linux Kernel	5.19 ≤ version < 5.19.2
Linux Linux Kernel	5.5 ≤ version < 5.10.137

Configuration D

5 vulnerable

Vulnerable Software	Affected Versions
Canonical Ubuntu Linux	Version 14.04
Canonical Ubuntu Linux	Version 16.04
Canonical Ubuntu Linux	Version 18.04
Canonical Ubuntu Linux	Version 20.04
Canonical Ubuntu Linux	Version 22.04

Related CWEs

The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

References (30)

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-2586

Source: security@ubuntu.com

Third Party Advisory

https://lore.kernel.org/netfilter-devel/20220809170148.164591-1-cascardo@canonical.com/T/#t

Source: security@ubuntu.com

Mailing ListPatch

https://ubuntu.com/security/notices/USN-5557-1

Source: security@ubuntu.com

Third Party Advisory

https://ubuntu.com/security/notices/USN-5560-1

Source: security@ubuntu.com

Third Party Advisory

https://ubuntu.com/security/notices/USN-5560-2

Source: security@ubuntu.com

Third Party Advisory

https://ubuntu.com/security/notices/USN-5562-1

Source: security@ubuntu.com

Third Party Advisory

https://ubuntu.com/security/notices/USN-5564-1

Source: security@ubuntu.com

Third Party Advisory

https://ubuntu.com/security/notices/USN-5565-1

Source: security@ubuntu.com

Third Party Advisory

https://ubuntu.com/security/notices/USN-5566-1

Source: security@ubuntu.com

Third Party Advisory

https://ubuntu.com/security/notices/USN-5567-1

Source: security@ubuntu.com

Third Party Advisory

https://ubuntu.com/security/notices/USN-5582-1

Source: security@ubuntu.com

Third Party Advisory

https://www.openwall.com/lists/oss-security/2022/08/09/5

Source: security@ubuntu.com

Mailing List

https://www.zerodayinitiative.com/advisories/ZDI-22-1118/

Source: security@ubuntu.com

Third Party AdvisoryVDB Entry

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-2586

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://lore.kernel.org/netfilter-devel/20220809170148.164591-1-cascardo@canonical.com/T/#t

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing ListPatch

https://ubuntu.com/security/notices/USN-5557-1

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://ubuntu.com/security/notices/USN-5560-1

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://ubuntu.com/security/notices/USN-5560-2

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://ubuntu.com/security/notices/USN-5562-1

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://ubuntu.com/security/notices/USN-5564-1

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://ubuntu.com/security/notices/USN-5565-1

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://ubuntu.com/security/notices/USN-5566-1

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://ubuntu.com/security/notices/USN-5567-1

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://ubuntu.com/security/notices/USN-5582-1

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://www.openwall.com/lists/oss-security/2022/08/09/5

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing List

https://www.vicarius.io/vsociety/posts/use-after-free-vulnerability-linked-chain-between-nft-tables-cve-2022-2586

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitThird Party Advisory

https://www.zerodayinitiative.com/advisories/ZDI-22-1118/

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party AdvisoryVDB Entry

https://cert-portal.siemens.com/productcert/html/ssa-794697.html

Source: 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e

Third Party Advisory

https://cert-portal.siemens.com/productcert/html/ssa-806742.html

Source: 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e

Third Party Advisory

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-2586

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

US Government Resource

Timeline

No history available yet.