CVE-2022-48637
published 2024-04-28CVE-2022-48637: In the Linux kernel, the following vulnerability has been resolved: bnxt: prevent skb UAF after handing over to PTP worker When reading the timestamp is…
PriorityP339high7.8CVSS 3.1
AVLACLPRLUINSUCHIHAH
EPSS
0.23%
13.6th percentile
In the Linux kernel, the following vulnerability has been resolved:
bnxt: prevent skb UAF after handing over to PTP worker
When reading the timestamp is required bnxt_tx_int() hands
over the ownership of the completed skb to the PTP worker.
The skb should not be used afterwards, as the worker may
run before the rest of our code and free the skb, leading
to a use-after-free.
Since dev_kfree_skb_any() accepts NULL make the loss of
ownership more obvious and set skb to NULL.
Affected
11 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 6.0.2-1 (bookworm) | linux 6.0.2-1 (bookworm) |
| linux | linux | — | — |
| linux | linux | >= 83bb623c968e7351aee5111547693f95f330dc5a < 08483e4c0c83b221b8891434a04cec405dee94a6 | 08483e4c0c83b221b8891434a04cec405dee94a6 |
| linux | linux | >= 83bb623c968e7351aee5111547693f95f330dc5a < 32afa1f23e42cc635ccf4c39f24514d03d1e8338 | 32afa1f23e42cc635ccf4c39f24514d03d1e8338 |
| linux | linux | >= 83bb623c968e7351aee5111547693f95f330dc5a < c31f26c8f69f776759cbbdfb38e40ea91aa0dd65 | c31f26c8f69f776759cbbdfb38e40ea91aa0dd65 |
| linux | linux_kernel | — | — |
| linux | linux_kernel | >= 0 < 6.0.2-1 | 6.0.2-1 |
| linux | linux_kernel | >= 0 < 6.0.2-1 | 6.0.2-1 |
| linux | linux_kernel | >= 0 < 6.0.2-1 | 6.0.2-1 |
| linux | linux_kernel | >= 5.14 < 5.15.71 | 5.15.71 |
| linux | linux_kernel | >= 5.16 < 5.19.12 | 5.19.12 |
CVSS provenance
nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
osv7.8HIGH
vendor_debian7.8HIGH
vendor_redhat7.8HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
kernel: bnxt: prevent skb UAF after handing over to PTP worker
vendor_redhat·2024-04-28·CVSS 7.8
CVE-2022-48637 [HIGH] CWE-416 kernel: bnxt: prevent skb UAF after handing over to PTP worker
kernel: bnxt: prevent skb UAF after handing over to PTP worker
In the Linux kernel, the following vulnerability has been resolved:
bnxt: prevent skb UAF after handing over to PTP worker
When reading the timestamp is required bnxt_tx_int() hands
over the ownership of the completed skb to the PTP worker.
The skb should not be used afterwards, as the worker may
run before the rest of our code and free the skb, leading
to a use-after-free.
Since dev_kfree_skb_any() accepts NULL make the loss of
ownership more obvious and set skb to NULL.
A possible use-after-free after handing over to PTP worker was found in the Linux kernel. This may lead to a crash.
Package: kernel (Red Hat Enterprise Linux 6) - Not affected
Package: kernel (Red Hat Enterprise Linux 7) - Out of support scope
Package: ke
Debian
CVE-2022-48637: linux - In the Linux kernel, the following vulnerability has been resolved: bnxt: preve...
vendor_debian·2022·CVSS 7.8
CVE-2022-48637 [HIGH] CVE-2022-48637: linux - In the Linux kernel, the following vulnerability has been resolved: bnxt: preve...
In the Linux kernel, the following vulnerability has been resolved: bnxt: prevent skb UAF after handing over to PTP worker When reading the timestamp is required bnxt_tx_int() hands over the ownership of the completed skb to the PTP worker. The skb should not be used afterwards, as the worker may run before the rest of our code and free the skb, leading to a use-after-free. Since dev_kfree_skb_any() accepts NULL make the loss of ownership more obvious and set skb to NULL.
Scope: local
bookworm: resolved (fixed in 6.0.2-1)
bullseye: resolved
forky: resolved (fixed in 6.0.2-1)
sid: resolved (fixed in 6.0.2-1)
trixie: resolved (fixed in 6.0.2-1)
OSV
CVE-2022-48637: In the Linux kernel, the following vulnerability has been resolved: bnxt: prevent skb UAF after handing over to PTP worker When reading the timestamp
osv·2024-04-28·CVSS 7.8
CVE-2022-48637 [HIGH] CVE-2022-48637: In the Linux kernel, the following vulnerability has been resolved: bnxt: prevent skb UAF after handing over to PTP worker When reading the timestamp
In the Linux kernel, the following vulnerability has been resolved: bnxt: prevent skb UAF after handing over to PTP worker When reading the timestamp is required bnxt_tx_int() hands over the ownership of the completed skb to the PTP worker. The skb should not be used afterwards, as the worker may run before the rest of our code and free the skb, leading to a use-after-free. Since dev_kfree_skb_any() accepts NULL make the loss of ownership more obvious and set skb to NULL.
GHSA
GHSA-whgw-qcmx-gp47: In the Linux kernel, the following vulnerability has been resolved:
bnxt: prevent skb UAF after handing over to PTP worker
When reading the timestam
ghsa_unreviewed·2024-04-28
CVE-2022-48637 [HIGH] CWE-416 GHSA-whgw-qcmx-gp47: In the Linux kernel, the following vulnerability has been resolved:
bnxt: prevent skb UAF after handing over to PTP worker
When reading the timestam
In the Linux kernel, the following vulnerability has been resolved:
bnxt: prevent skb UAF after handing over to PTP worker
When reading the timestamp is required bnxt_tx_int() hands
over the ownership of the completed skb to the PTP worker.
The skb should not be used afterwards, as the worker may
run before the rest of our code and free the skb, leading
to a use-after-free.
Since dev_kfree_skb_any() accepts NULL make the loss of
ownership more obvious and set skb to NULL.
No detection rules found.
No public exploits indexed.
https://git.kernel.org/stable/c/08483e4c0c83b221b8891434a04cec405dee94a6https://git.kernel.org/stable/c/32afa1f23e42cc635ccf4c39f24514d03d1e8338https://git.kernel.org/stable/c/c31f26c8f69f776759cbbdfb38e40ea91aa0dd65https://git.kernel.org/stable/c/08483e4c0c83b221b8891434a04cec405dee94a6https://git.kernel.org/stable/c/32afa1f23e42cc635ccf4c39f24514d03d1e8338https://git.kernel.org/stable/c/c31f26c8f69f776759cbbdfb38e40ea91aa0dd65
2024-04-28
Published