Vulnerability Report

CVE-2022-21505

Title: Oracle Linux

Other

Proof Of Concept

No public PoC currently indexed for CVE-2022-21505.

CWE Category CWE-346
Published Date Dec 24, 2024
Modified Date Jun 18, 2025
Exploit Status Not Found
Score 6.7 CVSS v3.1
Exploit Probability (EPSS)
0.20%

Vulnerability Summary

CVE-2022-21505: In the linux kernel, if IMA appraisal is used with the "ima_appraise=log" boot param, lockdown can be defeated with kexec on any machine when Secure Boot is disabled or unavailable. IMA prevents setting "ima_appraise=log" from the boot param when Secure Boot is enabled, but this does not cover cases where lockdown is used without Secure Boot. CVSS 3.1 Base Score 6.7 (Confidentiality, Integrity, Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).

Impacted Vendors

C
conectiva 1
S
sun 1
O
oracle 1
C
cyrix 1

Reference Links

https://git.kernel.org/linus/543ce63b664e2c2f9533d089a4664b559c3e6b5b https://linux.oracle.com/cve/CVE-2022-21505.html
CVSS v3.1
Source Entity [email protected]
Severity MEDIUM
6.7
Attack Vector
LOCAL
Complexity
LOW
Privileges
N/A
Interaction
NONE
Confidentiality
N/A
Integrity
N/A
Availability
N/A
Scope
UNCHANGED
RAW VECTOR CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Associated Attack Patterns (CAPEC)

Total: Patterns

CVE-2022-21505 Exploits & PoCs (Proof Of Concept)

No public PoCs found in our database for this CVE.

MODIFIED

Vulnerability data or affected products updated.

PUBLISHED

Vulnerability first announced in NVD.

Attack Vector Matrix

Access Vector LOCAL
Complexity LOW
Privileges N/A
Interaction NONE
CVSS Vector String CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Affected Stack

No specific products linked.