medium 6.3

CVE-2022-1462 json

An out-of-bounds read flaw was found in the Linux kernel’s TeleTYpe subsystem.

published 2022-05-31 4 y ago modified 2026-10-14 25 d ago also EUVD-2022-24767

cvss: 6.3; version 3.1, NVD
cisa kev: Not listed; not in CISA's catalog
epss: 0.3%; EPSS 0.3% chance of exploitation in 30 days, percentile 27%
public exploits: 0; none known

An out-of-bounds read flaw was found in the Linux kernel’s TeleTYpe subsystem. The issue occurs in how a user triggers a race condition using ioctls TIOCSPTLCK and TIOCGPTPEER and TIOCSTI and TCXONC with leakage of memory in the flush_to_ldisc function. This flaw allows a local user to crash the system or read unauthorized random data from memory.

Patch / fix

fixed in 1 distros 6

Siemens SIMATIC S7-1500 TM MFP - GNU/Linux subsystem V1.1

debian ubuntu red hat suse opensuse almalinux

linux Debian 14, Debian 13, Debian 12 5.18.14-1

debian advisories DEBIAN-CVE-2022-1462

linux Ubuntu 18.04 LTS 4.15.0-197.208
linux Ubuntu 20.04 LTS 5.4.0-128.144
linux Ubuntu 22.04 LTS 5.15.0-50.56
linux-aws Ubuntu 18.04 LTS 4.15.0-1143.155
linux-aws Ubuntu 20.04 LTS 5.4.0-1086.93
linux-aws Ubuntu 22.04 LTS 5.15.0-1021.25
linux-gcp Ubuntu 20.04 LTS 5.4.0-1090.98
linux-gcp Ubuntu 22.04 LTS 5.15.0-1019.25

ubuntu advisories UBUNTU-CVE-2022-1462

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

perf rhev hypervisor 4.4, RHEL 8.6 EUS 4.18.0-372.91.1.el8_6
kernel RHEL 9 5.14.0-284.11.1.el9_2
perf RHEL 9 5.14.0-284.11.1.el9_2
rtla RHEL 9 5.14.0-284.11.1.el9_2
bpftool RHEL 9 7.0.0-284.11.1.el9_2
kernel-64k RHEL 9 5.14.0-284.11.1.el9_2
kernel-core RHEL 9 5.14.0-284.11.1.el9_2
kernel-tools RHEL 9 5.14.0-284.11.1.el9_2

red hat advisories RHSA-2024:0724 RHSA-2023:2458 RHSA-2023:2148 RHSA-2023:2736 RHSA-2023:2951

kernel-rt SLE Real Time 12 SP5 4.12.14-10.97.1
kernel-syms-rt SLE Real Time 12 SP5 4.12.14-10.97.1
kernel-rt_debug SLE Real Time 12 SP5 4.12.14-10.97.1
kernel-source-rt SLE Real Time 12 SP5 4.12.14-10.97.1
kernel-rt SLE Micro 5.2, SLE Micro 5.1, Real Time Module 15 SP3 +1 more 5.3.18-150300.99.1
kernel-syms-rt Real Time Module 15 SP3 5.3.18-150300.99.1
kernel-rt_debug Real Time Module 15 SP3 5.3.18-150300.99.1
kernel-source-rt Real Time Module 15 SP3 5.3.18-150300.99.1

suse advisories SUSE-SU-2023:0416-1 SUSE-SU-2022:2910-1 SUSE-SU-2022:2892-2 SUSE-SU-2022:2892-1 SUSE-SU-2022:2875-2 SUSE-SU-2022:2875-1

kernel-source openSUSE Tumbleweed 5.18.11-1.1
kernel-source openSUSE Tumbleweed 6.6.17-1.1

opensuse advisories openSUSE-SU-2024:12193-1 openSUSE-SU-2024:13704-1

kernel-rt AlmaLinux 8 4.18.0-477.10.1.rt7.274.el8_8
kernel-rt-kvm AlmaLinux 8 4.18.0-477.10.1.rt7.274.el8_8
kernel-rt-core AlmaLinux 8 4.18.0-477.10.1.rt7.274.el8_8
kernel-rt-modules AlmaLinux 8 4.18.0-477.10.1.rt7.274.el8_8
kernel-rt-debug-kvm AlmaLinux 8 4.18.0-477.10.1.rt7.274.el8_8
kernel-rt-debug-core AlmaLinux 8 4.18.0-477.10.1.rt7.274.el8_8
kernel-rt-debug-modules AlmaLinux 8 4.18.0-477.10.1.rt7.274.el8_8
kernel-rt-modules-extra AlmaLinux 8 4.18.0-477.10.1.rt7.274.el8_8

almalinux advisories ALSA-2023:2736 ALSA-2023:2951 ALSA-2023:2148 ALSA-2023:2458

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2022-1462 updated 2026-11-07 cvss 6.3

kernel: possible race condition in drivers/tty/tty_buffers.c

Red Hat CodeReady Linux Builder EUS (v.8.6) kernel-debuginfo-common-x86_64 4.18.0-372.91.1.el8_6, kernel-debuginfo-common-aarch64 4.18.0-372.91.1.el8_6, kernel-debuginfo-common-ppc64le 4.18.0-372.91.1.el8_6
fixed: vendor fix RHSA-2024:0724
Red Hat Enterprise Linux AppStream (v. 9) perf 5.14.0-284.11.1.el9_2, rtla 5.14.0-284.11.1.el9_2, kernel-devel-matched 5.14.0-284.11.1.el9_2, kernel-64k-devel-matched 5.14.0-284.11.1.el9_2, kernel-debug-devel-matched 5.14.0-284.11.1.el9_2, kernel-debuginfo-common-s390x 5.14.0-284.11.1.el9_2, +5 more
fixed: vendor fix RHSA-2023:2458
Red Hat Enterprise Linux BaseOS (v. 8) perf 4.18.0-477.10.1.el8_8, kernel 4.18.0-477.10.1.el8_8, bpftool 4.18.0-477.10.1.el8_8, kernel-core 4.18.0-477.10.1.el8_8, kernel-tools 4.18.0-477.10.1.el8_8, python3-perf 4.18.0-477.10.1.el8_8, +15 more
fixed: vendor fix RHSA-2023:2951
Red Hat Enterprise Linux BaseOS (v. 9) bpftool 7.0.0-284.11.1.el9_2, kernel 5.14.0-284.11.1.el9_2, kernel-64k 5.14.0-284.11.1.el9_2, kernel-core 5.14.0-284.11.1.el9_2, kernel-tools 5.14.0-284.11.1.el9_2, python3-perf 5.14.0-284.11.1.el9_2, +28 more
fixed: vendor fix RHSA-2023:2458
Red Hat Enterprise Linux BaseOS EUS (v.8.6) perf 4.18.0-372.91.1.el8_6, kernel 4.18.0-372.91.1.el8_6, bpftool 4.18.0-372.91.1.el8_6, kernel-core 4.18.0-372.91.1.el8_6, kernel-tools 4.18.0-372.91.1.el8_6, python3-perf 4.18.0-372.91.1.el8_6, +15 more
fixed: vendor fix RHSA-2024:0724
Red Hat Enterprise Linux CRB (v. 8) kernel-debuginfo-common-x86_64 4.18.0-477.10.1.el8_8, kernel-debuginfo-common-aarch64 4.18.0-477.10.1.el8_8, kernel-debuginfo-common-ppc64le 4.18.0-477.10.1.el8_8
fixed: vendor fix RHSA-2023:2951
Red Hat Enterprise Linux CRB (v. 9) kernel-debuginfo-common-s390x 5.14.0-284.11.1.el9_2, kernel-debuginfo-common-x86_64 5.14.0-284.11.1.el9_2, kernel-debuginfo-common-aarch64 5.14.0-284.11.1.el9_2, kernel-debuginfo-common-ppc64le 5.14.0-284.11.1.el9_2
fixed: vendor fix RHSA-2023:2458
Red Hat Enterprise Linux NFV (v. 8) kernel-rt 4.18.0-477.10.1.rt7.274.el8_8, kernel-rt-kvm 4.18.0-477.10.1.rt7.274.el8_8, kernel-rt-core 4.18.0-477.10.1.rt7.274.el8_8, kernel-rt-modules 4.18.0-477.10.1.rt7.274.el8_8, kernel-rt-debug-kvm 4.18.0-477.10.1.rt7.274.el8_8, kernel-rt-debug-core 4.18.0-477.10.1.rt7.274.el8_8, +4 more
fixed: vendor fix RHSA-2023:2736

show 5 more

Red Hat Enterprise Linux NFV (v. 9) kernel-rt 5.14.0-284.11.1.rt14.296.el9_2, kernel-rt-kvm 5.14.0-284.11.1.rt14.296.el9_2, kernel-rt-core 5.14.0-284.11.1.rt14.296.el9_2, kernel-rt-modules 5.14.0-284.11.1.rt14.296.el9_2, kernel-rt-debug-kvm 5.14.0-284.11.1.rt14.296.el9_2, kernel-rt-debug-core 5.14.0-284.11.1.rt14.296.el9_2, +6 more
fixed: vendor fix RHSA-2023:2148
Red Hat Enterprise Linux RT (v. 8) kernel-rt 4.18.0-477.10.1.rt7.274.el8_8, kernel-rt-core 4.18.0-477.10.1.rt7.274.el8_8, kernel-rt-modules 4.18.0-477.10.1.rt7.274.el8_8, kernel-rt-debug-core 4.18.0-477.10.1.rt7.274.el8_8, kernel-rt-debug-modules 4.18.0-477.10.1.rt7.274.el8_8, kernel-rt-modules-extra 4.18.0-477.10.1.rt7.274.el8_8, +2 more
fixed: vendor fix RHSA-2023:2736
Red Hat Enterprise Linux RT (v. 9) kernel-rt 5.14.0-284.11.1.rt14.296.el9_2, kernel-rt-core 5.14.0-284.11.1.rt14.296.el9_2, kernel-rt-modules 5.14.0-284.11.1.rt14.296.el9_2, kernel-rt-debug-core 5.14.0-284.11.1.rt14.296.el9_2, kernel-rt-modules-core 5.14.0-284.11.1.rt14.296.el9_2, kernel-rt-debug-modules 5.14.0-284.11.1.rt14.296.el9_2, +4 more
fixed: vendor fix RHSA-2023:2148
Red Hat Virtualization 4 Hypervisor for RHEL 8 perf 4.18.0-372.91.1.el8_6, kernel-debuginfo-common-x86_64 4.18.0-372.91.1.el8_6
fixed: vendor fix RHSA-2024:0724
Red Hat Enterprise Linux 6 perf, kernel, python-perf, kernel-kdump, kernel-firmware, kernel-bootwrapper, +1 more Red Hat Enterprise Linux 7 perf, kernel, bpftool, kernel-rt, python-perf, kernel-kdump, +8 more
not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

cisa ICSA-23-166-11 updated 2024-04-09 cvss 6.3

Siemens SIMATIC S7-1500 TM MFP Linux Kernel

Siemens SIMATIC S7-1500 TM MFP - GNU/Linux subsystem <V1.1
affected: fixed in V1.1, workaround support.industry.siemens.com

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

Exploit prediction

0.34% chance of exploitation in the next 30 days, higher than 27% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

seclists.org https://seclists.org/oss-sec/2022/q2/155 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by	version	score	vector
NVD	3.1	6.3	CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:H
NVD	2.0	3.3	AV:L/AC:M/Au:N/C:P/I:N/A:P

Affected products

n/a kernel
Siemens SIMATIC S7-1500 TM MFP - GNU/Linux subsystem

Classification

Weakness

CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization

Technology feeds

Linux kernel rss critical rss

References

seclists.org /oss-sec/2022/q2/155
exploit, mailing-list, third-party-advisory
bugzilla.redhat.com /show_bug.cgi?id=2078466
issue-tracking, third-party-advisory
lists.debian.org /debian-lts-announce/2022/10/msg00000.html
mailing-list, third-party-advisory
cert-portal.siemens.com /productcert/html/ssa-794697.html

Sources

CVE List CVE-2022-1462
NVD CVE-2022-1462

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

CPEs and fixed versions use Anchore's correction of NVD's data: Correct CPE for linux kernel from type `a` to `o` and update version ranges.

Summary