Privilege escalation in IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data
| Risk | Low |
| Patch available | YES |
| Number of vulnerabilities | 1 |
| CVE-ID | CVE-2022-27666 |
| CWE-ID | CWE-122 |
| Exploitation vector | Local |
| Public exploit | Public exploit code for vulnerability #1 is available. |
| Vulnerable software Subscribe |
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data Server applications / Other server solutions |
| Vendor | IBM Corporation |
Security Bulletin
This security bulletin contains one low risk vulnerability.
1) Heap-based buffer overflow
EUVDB-ID: #VU61672
Risk: Low
CVSSv3.1:
CVE-ID: CVE-2022-27666
CWE-ID:
CWE-122 - Heap-based Buffer Overflow
Exploit availability: Yes
DescriptionThe vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to a boundary error within IPsec ESP transformation code in net/ipv4/esp4.c and net/ipv6/esp6.c in Linux kernel. A local unprivileged user can pass specially crafted data to the system, trigger a heap-based buffer overflow and execute arbitrary code with elevated privileges.
Install update from vendor's website.
Vulnerable software versionsIBM Watson Speech Services Cartridge for IBM Cloud Pak for Data : before 4.5.3
CPE2.3
http://www.ibm.com/blogs/psirt/security-bulletin-ibm-watson-speech-services-cartridge-for-ibm-cloud-pak-for-data-is-vulnerable-to-elevated-privileges-in-linux-kernel-cve-2022-27666/
http://www.ibm.com/support/pages/node/6829143
Q & A
Can this vulnerability be exploited remotely?
Is there known malware, which exploits this vulnerability?
