Wind River Support Network

HomeDefectsLIN1022-1007

Fixed

LIN1022-1007 : Security Advisory - linux - CVE-2022-21505

Created: Jul 19, 2022 Updated: Jan 26, 2026

Resolved Date: Aug 4, 2022

Found In Version: 10.22.33.1

Fix Version: 10.22.33.1

Severity: Standard

Applicable for: Wind River Linux LTS 22

Component/s: Kernel

Description

In the linux kernel, if IMA appraisal is used with the "ima_appraise=log" boot param, lockdown can be defeated with kexec on any machine when Secure Boot is disabled or unavailable. IMA prevents setting "ima_appraise=log" from the boot param when Secure Boot is enabled, but this does not cover cases where lockdown is used without Secure Boot. CVSS 3.1 Base Score 6.7 (Confidentiality, Integrity, Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).

https://nvd.nist.gov/vuln/detail/CVE-2022-21505