Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Mon, 11 Apr 2022 16:20:56 +0800
From: Felix Fu <>
Subject: CVE-2022-28893: Linux kernel: Use after free in SUNRPC subsystem

Hello, I Request a CVE from MITRE.

Description: The SUNRPC subsystem in the Linux kernel through 5.17.2 can
call xs_xprt_free before ensuring that sockets are in the intended state.
Details: Use after free happens in inet_put_port because some sockets are
not close before xs_xprt_free().
CVE-ID: CVE-2022-28893  (

I followed the steps as below :

To report minor security bugs (such as local DOS or local info leak):

1、Report the bug publicly to kernel developers as described above and wait
until a fix is committed. Alternatively, you can develop and send a fix

2、Request a CVE from MITRE through the web form. Describe the bug details
and add a link to the fix (from, or in the request.

3、Once a CVE is assigned, send the bug details, the CVE number and a link
to the fix to


Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.