CVE-2022-2639
Quick assessment
Affected
n/a kernel
Exploitation
Public or AI PoC available; prioritize validation
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在数字错误漏洞，该漏洞源于在 openvswitch 内核模块中发现整数强制错误。 给定足够多的操作，在为新流的新操作复制和保留内存时，reserve_sfa_size() 函数不会按预期返回 -EMSGSIZE，这可能会导致越界写入访问。 此漏洞允许本地用户崩溃或可能提升他们在系统上的权限。
Possible ATT&CK Techniques 2 AI
T1068 · Exploitation for Privilege Escalation T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2022-2639
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Source: CVE Program / CVE List V5
Vulnerability Description
An integer coercion error was found in the openvswitch kernel module. Given a sufficiently large number of actions, while copying and reserving memory for a new action of a new flow, the reserve_sfa_size() function does not return -EMSGSIZE as expected, potentially leading to an out-of-bounds write access. This flaw allows a local user to crash or potentially escalate their privileges on the system.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
整数强制转换错误
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 数字错误漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在数字错误漏洞，该漏洞源于在 openvswitch 内核模块中发现整数强制错误。 给定足够多的操作，在为新流的新操作复制和保留内存时，reserve_sfa_size() 函数不会按预期返回 -EMSGSIZE，这可能会导致越界写入访问。 此漏洞允许本地用户崩溃或可能提升他们在系统上的权限。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| - | kernel | kernel 5.18 | - |
|
II. Public POCs for CVE-2022-2639
| # | POC Description | Source Link | Shenlong Link |
|---|---|---|---|
| 1 | CVE-2022-2639 Linux kernel openvswitch local privilege escalation | https://github.com/bb33bb/CVE-2022-2639-PipeVersion | POC Details |
| 2 | None | https://github.com/EkamSinghWalia/Detection-and-Mitigation-for-CVE-2022-2639 | POC Details |
| 3 | None | https://github.com/kakaroot1337/-2022-LOCALROOT-CVE-2022-2639 | POC Details |
| 4 | None | https://github.com/letsr00t/-2022-LOCALROOT-CVE-2022-2639 | POC Details |
| 5 | None | https://github.com/devetop/CVE-2022-2639-PipeVersion | POC Details |
| 6 | None | https://github.com/Threekiii/Awesome-POC/blob/master/%E6%93%8D%E4%BD%9C%E7%B3%BB%E7%BB%9F%E6%BC%8F%E6%B4%9E/Linux%20openvswitch%20%E6%9D%83%E9%99%90%E6%8F%90%E5%8D%87%E6%BC%8F%E6%B4%9E%20CVE-2022-2639.md | POC Details |
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2022-2639
请登录查看更多情报信息。
Patches & Fixes for CVE-2022-2639 (1)
Vendor Advisories for CVE-2022-2639 (1)
-
https://bugzilla.redhat.com/show_bug.cgi?id=2084479 x_refsource_MISC
Same Patch Batch · n/a · 2022-09-01 · 49 CVEs total
| CVE-2022-1677 | Red Hat OpenShift Container Platform 资源管理错误漏洞 | |
| CVE-2022-2256 | Red Hat Keycloak 跨站脚本漏洞 | |
| CVE-2022-2308 | Linux kernel 安全漏洞 | |
| CVE-2022-2447 | OpenStack 安全漏洞 | |
| CVE-2022-2738 | Red Hat Enterprise Linux 资源管理错误漏洞 | |
| CVE-2022-2739 | Red Hat Enterprise Linux 信息泄露漏洞 | |
| CVE-2022-3078 | Linux kernel 代码问题漏洞 | |
| CVE-2022-23452 | barbican 授权问题漏洞 | |
| CVE-2022-2403 | Red Hat OpenShift Container Platform 信息泄露漏洞 | |
| CVE-2022-1902 | Red Hat stackrox 安全漏洞 | |
| CVE-2022-2238 | Red Hat search-api 资源管理错误漏洞 | |
| CVE-2022-36604 | Canaan Avalon ASIC Miner 访问控制错误漏洞 | |
| CVE-2022-36603 | InnoSilicon T3T+ 安全漏洞 | |
| CVE-2022-36602 | InnoSilicon A10 安全漏洞 | |
| CVE-2022-36601 | JASMINER X4 Server 安全漏洞 | |
| CVE-2020-27784 | Linux kernel 资源管理错误漏洞 | |
| CVE-2020-35533 | Libraw 缓冲区错误漏洞 | |
| CVE-2020-35534 | Libraw 安全漏洞 | |
| CVE-2020-35535 | Libraw 缓冲区错误漏洞 | |
| CVE-2020-35530 | Libraw 缓冲区错误漏洞 |
Showing top 20 of 49 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: kernel
-
CVE-2025-26604
Possibility to retrieve bot token by malicious module develo -
CVE-2021-35000
OpenBSD Kernel Multicast Routing Uninitialized Memory Inform -
CVE-2021-34999
OpenBSD Kernel Multicast Routing Uninitialized Memory Inform -
CVE-2021-34981
Linux Kernel Bluetooth CMTP Module Double Free Privilege Esc -
CVE-2024-24898
Information Leakage in kernel
Same vendor: n/a
-
CVE-2026-78187
Piwigo Public Authentication cross site scripting -
CVE-2026-78186
Open5GS HSS hss-cx-path.c assertion -
CVE-2026-78178
jQWidgets jqx-all.js jqxBaseFramework.extend prototype pollu -
CVE-2026-78158
Open5GS AMF UEContextReleaseRequest Path improper authorizat -
CVE-2026-78157
Open5GS Rx AA-Request pcrf-rx-path.c pcrf_rx_aar_cb out-of-b
Same weakness: CWE-192
-
CVE-2026-8276
bettercap MySQL Server mysql_server.go integer coercion -
CVE-2026-8275
bettercap zerogod IPP Service zerogod_ipp_primitives.go ippR -
CVE-2014-125012
FFmpeg dxtroy.c integer coercion -
CVE-2014-125011
FFmpeg ansi.c decode_frame integer coercion -
CVE-2021-32996
FANUC Robotics Virtual Robot Controller 缓冲区错误漏洞
V. Comments for CVE-2022-2639
No comments yet