Medium severity · published Dec 24, 2024
CVE-2022-21505
In the linux kernel, if IMA appraisal is used with the "ima_appraise=log" boot param, lockdown can be defeated with kexec on any machine when Secure Boot is disabled or…
6.7
CVSS
0.2%
EPSS
No
On KEV
Description
In the linux kernel, if IMA appraisal is used with the "ima_appraise=log" boot param, lockdown can be defeated with kexec on any machine when Secure Boot is disabled or unavailable. IMA prevents setting "ima_appraise=log" from the boot param when Secure Boot is enabled, but this does not cover cases where lockdown is used without Secure Boot. CVSS 3.1 Base Score 6.7 (Confidentiality, Integrity, Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 10% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OL
Oracle Linux · Oracle Corporation
Oracle Linux: 7; Oracle Linux: 8; Oracle Linux: 9 · source: vendor
LI
Linux · Oracle
7; 8; 9 · source: NVD
SS
SIMATIC S7-1500 TM MFP - GNU/Linux subsystem · Siemens
before V1.1 · source: CISA
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-21505
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-21505
Broken Link
https://git.kernel.org/linus/543ce63b664e2c2f9533d089a4664b559c3e6b5b
Vendor Advisory
https://linux.oracle.com/cve/CVE-2022-21505.html
cert-portal.siemens.com
https://cert-portal.siemens.com/productcert/html/ssa-794697.html
More from Oracle Linux
5.5
CVE-2026-21996
An unprivileged attacker can reliably trigger a crash of the dtrace process with a malicious ELF binary due to an integer Divide-by-Zero in Pbuild_file_symtab()
5.5
CVE-2026-21991
A DTrace component, dtprobed, allows arbitrary file creation through crafted USDT provider names
4.4
CVE-2026-35233
An unprivileged attacker can craft a user-space process with a malicious ELF binary containing an out-of-range sh_link field