CVE-2022-0480
MEDIUMCVSS 5.5/10EPSS 0.27%
Last modified
CVE-2022-0480 is a medium-severity vulnerability rated 5.5/10 on the CVSS scale. A flaw was found in the filelock_init in fs/locks.c function in the Linux kernel. This issue can lead to host memory exhaustion due to memcg not limiting the number of Portable Operating System Interface (POSIX) file locks.. EPSS estimates a 0.27% chance of exploitation in the next 30 days.
Description
A flaw was found in the filelock_init in fs/locks.c function in the Linux kernel. This issue can lead to host memory exhaustion due to memcg not limiting the number of Portable Operating System Interface (POSIX) file locks.
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Linux | Linux Kernel | < 5.15 |
| Redhat | Enterprise Linux | 9.0 |
References
- https://access.redhat.com/security/cve/CVE-2022-0480Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2049700Issue Tracking, Third Party Advisory
- https://github.com/kata-containers/kata-containers/issues/3373Issue Tracking, Third Party Advisory
- https://ubuntu.com/security/CVE-2022-0480Third Party Advisory
- https://access.redhat.com/security/cve/CVE-2022-0480Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2049700Issue Tracking, Third Party Advisory
- https://github.com/kata-containers/kata-containers/issues/3373Issue Tracking, Third Party Advisory
- https://ubuntu.com/security/CVE-2022-0480Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2022-0480?
A flaw was found in the filelock_init in fs/locks.c function in the Linux kernel. This issue can lead to host memory exhaustion due to memcg not limiting the number of Portable Operating System Interface (POSIX) file locks.
How severe is CVE-2022-0480?
CVE-2022-0480 has a CVSS score of 5.5/10 (MEDIUM severity). The EPSS model estimates a 0.27% probability of exploitation in the next 30 days.
How do I fix CVE-2022-0480?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2022
- CVE-2022-0474Full list of recipients from customer users in a contact fie…3.5
- CVE-2022-0475Malicious translator is able to inject JavaScript code in fe…5.4
- CVE-2022-0476Denial of Service in GitHub repository radareorg/radare2 pri…5.5
- CVE-2022-0477An issue has been discovered in GitLab affecting all version…4.9
- CVE-2022-0478The Event Manager and Tickets Selling for WooCommerce WordPr…8.8
- CVE-2022-0479The Popup Builder WordPress plugin before 4.1.1 does not san…9.8
- CVE-2022-0481NULL Pointer Dereference in Homebrew mruby prior to 3.2.7.5
- CVE-2022-0482Exposure of Private Personal Information to an Unauthorized …9.1
- CVE-2022-0483Local privilege escalation due to insecure folder permission…7.8
- CVE-2022-0484Lack of validation of URLs causes Mirantis Container Cloud L…8.8
- CVE-2022-0485A flaw was found in the copying tool `nbdcopy` of libnbd. Wh…4.8
- CVE-2022-0486Improper file permissions in the CommandPost, Collector, Sen…7.8
Are you affected by CVE-2022-0480?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST