CVE-2022-28390

Published: Apr 3, 2022Modified: Jun 17, 2026

7.8

Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitability: 1.8 / Impact: 5.9

Source: NVD

Description

ems_usb_start_xmit in drivers/net/can/usb/ems_usb.c in the Linux kernel through 5.17.1 has a double free.

Affected (15)

Products: Linux: Linux Kernel · Fedoraproject: Fedora · Debian: Debian Linux · +1 more

Show all products

Linux: Linux Kernel · Fedoraproject: Fedora · Debian: Debian Linux · Netapp: Hci Baseboard Management Controller

1 product

1 product

1 product

1 product

Hci Baseboard Management Controller

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Linux Linux Kernel	From 2.6.32 to 5.17.1

Configuration B

3 vulnerable

Vulnerable Software	Affected Versions
Fedoraproject Fedora	Version 34
Fedoraproject Fedora	Version 35
Fedoraproject Fedora	Version 36

Configuration C

3 vulnerable

Vulnerable Software	Affected Versions
Debian Debian Linux	Version 10.0
Debian Debian Linux	Version 11.0
Debian Debian Linux	Version 9.0

Configuration D

8 vulnerable

Vulnerable Software	Affected Versions
Netapp Hci Baseboard Management Controller	Version h300e
Netapp Hci Baseboard Management Controller	Version h300s
Netapp Hci Baseboard Management Controller	Version h410c
Netapp Hci Baseboard Management Controller	Version h410s
Netapp Hci Baseboard Management Controller	Version h500e
Netapp Hci Baseboard Management Controller	Version h500s
Netapp Hci Baseboard Management Controller	Version h700e
Netapp Hci Baseboard Management Controller	Version h700s

Related CWEs

The product calls free() twice on the same memory address, potentially leading to modification of unexpected memory locations.

References (16)

https://github.com/torvalds/linux/commit/c70222752228a62135cee3409dccefd494a24646

Source: cve@mitre.org

PatchThird Party Advisory

https://lists.debian.org/debian-lts-announce/2022/07/msg00000.html

Source: cve@mitre.org

Mailing ListThird Party Advisory

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6IHHC455LMSJNG4CSZ5CEAHYWY2DE5YW/

Source: cve@mitre.org

Third Party Advisory

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LAWC35TO642FOP3UCA3C6IF7NAUFOVZ6/

Source: cve@mitre.org

Third Party Advisory

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XFMPUI3WI4U2F7ONHRW36WDY4ZE7LGGT/

Source: cve@mitre.org

Third Party Advisory

https://security.netapp.com/advisory/ntap-20220513-0001/

Source: cve@mitre.org

Third Party Advisory

https://www.debian.org/security/2022/dsa-5127

Source: cve@mitre.org

Third Party Advisory

https://www.debian.org/security/2022/dsa-5173

Source: cve@mitre.org

Third Party Advisory

https://github.com/torvalds/linux/commit/c70222752228a62135cee3409dccefd494a24646

Source: af854a3a-2127-422b-91ae-364da2661108

PatchThird Party Advisory

https://lists.debian.org/debian-lts-announce/2022/07/msg00000.html

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing ListThird Party Advisory

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6IHHC455LMSJNG4CSZ5CEAHYWY2DE5YW/

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LAWC35TO642FOP3UCA3C6IF7NAUFOVZ6/

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XFMPUI3WI4U2F7ONHRW36WDY4ZE7LGGT/

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://security.netapp.com/advisory/ntap-20220513-0001/

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://www.debian.org/security/2022/dsa-5127

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://www.debian.org/security/2022/dsa-5173

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

Timeline

No history available yet.