CVE-2022-48687
published 2024-05-03CVE-2022-48687: In the Linux kernel, the following vulnerability has been resolved: ipv6: sr: fix out-of-bounds read when setting HMAC data. The SRv6 layer allows defining…
PriorityP424medium5.5CVSS 3.1
AVLACLPRLUINSUCHINAN
EPSS
0.24%
15.4th percentile
In the Linux kernel, the following vulnerability has been resolved:
ipv6: sr: fix out-of-bounds read when setting HMAC data.
The SRv6 layer allows defining HMAC data that can later be used to sign IPv6
Segment Routing Headers. This configuration is realised via netlink through
four attributes: SEG6_ATTR_HMACKEYID, SEG6_ATTR_SECRET, SEG6_ATTR_SECRETLEN and
SEG6_ATTR_ALGID. Because the SECRETLEN attribute is decoupled from the actual
length of the SECRET attribute, it is possible to provide invalid combinations
(e.g., secret = "", secretlen = 64). This case is not checked in the code and
with an appropriately crafted netlink message, an out-of-bounds read of up
to 64 bytes (max secret length) can occur past the skb end pointer and into
skb_shared_info:
Breakpoint 1, seg6_genl_sethmac (skb=, info=) at net/ipv6/seg6.c:208
208 memcpy(hinfo->secret, secret, slen);
(gdb) bt
#0 seg6_genl_sethmac (skb=, info=) at net/ipv6/seg6.c:208
#1 0xffffffff81e012e9 in genl_family_rcv_msg_doit (skb=skb@entry=0xffff88800b1f9f00, nlh=nlh@entry=0xffff88800b1b7600,
extack=extack@entry=0xffffc90000ba7af0, ops=ops@entry=0xffffc90000ba7a80, hdrlen=4, net=0xffffffff84237580 , family=,
family=) at net/netlink/genetlink.c:731
#2 0xffffffff81e01435 in genl_family_rcv_msg (extack=0xffffc90000ba7af0, nlh=0xffff88800b1b7600, skb=0xffff88800b1f9f00,
family=0xffffffff82fef6c0 ) at net/netlink/genetlink.c:775
#3 genl_rcv_msg (skb=0xffff88800b1f9f00, nlh=0xffff88800b1b7600, extack=0xffffc90000ba7af0) at net/netlink/genetlink.c:792
#4 0xffffffff81dfffc3 in netlink_rcv_skb (skb=skb@entry=0xffff88800b1f9f00, cb=cb@entry=0xffffffff81e01350 )
at net/netlink/af_netlink.c:2501
#5 0xffffffff81e00919 in genl_rcv (skb=0xffff88800b1f9f00) at net/netlink/genetlink.c:803
#6 0xffffffff81dff6ae in netlink_unicast_kernel (ssk=0xffff888010eec800, skb=0xffff88800b1f9f00, sk=0xffff888004aed000)
at net/netlink/af_netlink.c:1319
#7 netlink_unicast (ssk=ssk@entry=0xffff888010eec800, skb=skb@entry=0xffff88800b1f9f00, portid
Affected
19 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 5.19.11-1 (bookworm) | linux 5.19.11-1 (bookworm) |
| linux | linux | — | — |
| linux | linux | >= 4f4853dc1c9c1994f6f756eabdcc25374ff271d9 < dc9dbd65c803af1607484fed5da50d41dc8dd864 | dc9dbd65c803af1607484fed5da50d41dc8dd864 |
| linux | linux | >= 4f4853dc1c9c1994f6f756eabdcc25374ff271d9 < f684c16971ed5e77dfa25a9ad25b5297e1f58eab | f684c16971ed5e77dfa25a9ad25b5297e1f58eab |
| linux | linux | >= 4f4853dc1c9c1994f6f756eabdcc25374ff271d9 < 3df71e11a4773d775c3633c44319f7acdb89011c | 3df71e11a4773d775c3633c44319f7acdb89011c |
| linux | linux | >= 4f4853dc1c9c1994f6f756eabdcc25374ff271d9 < 076f2479fc5a15c4a970ca3b5e57d42ba09a31fa | 076f2479fc5a15c4a970ca3b5e57d42ba09a31fa |
| linux | linux | >= 4f4853dc1c9c1994f6f756eabdcc25374ff271d9 < 55195563ec29f80f984237b743de0e2b6ba4d093 | 55195563ec29f80f984237b743de0e2b6ba4d093 |
| linux | linux | >= 4f4853dc1c9c1994f6f756eabdcc25374ff271d9 < 56ad3f475482bca55b0ae544031333018eb145b3 | 56ad3f475482bca55b0ae544031333018eb145b3 |
| linux | linux | >= 4f4853dc1c9c1994f6f756eabdcc25374ff271d9 < 84a53580c5d2138c7361c7c3eea5b31827e63b35 | 84a53580c5d2138c7361c7c3eea5b31827e63b35 |
| linux | linux_kernel | >= 0 < 5.10.148-1 | 5.10.148-1 |
| linux | linux_kernel | >= 0 < 5.19.11-1 | 5.19.11-1 |
| linux | linux_kernel | >= 0 < 5.19.11-1 | 5.19.11-1 |
| linux | linux_kernel | >= 0 < 5.19.11-1 | 5.19.11-1 |
| linux | linux_kernel | >= 4.10 < 4.14.298 | 4.14.298 |
| linux | linux_kernel | >= 4.15 < 4.19.258 | 4.19.258 |
| linux | linux_kernel | >= 4.20 < 5.4.213 | 5.4.213 |
| linux | linux_kernel | >= 5.11 < 5.15.68 | 5.15.68 |
| linux | linux_kernel | >= 5.16 < 5.19.9 | 5.19.9 |
| linux | linux_kernel | >= 5.5 < 5.10.143 | 5.10.143 |
CVSS provenance
nvdv3.15.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
osv5.5MEDIUM
vendor_debian5.5MEDIUM
vendor_redhat5.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-pv89-33p5-9r7r: In the Linux kernel, the following vulnerability has been resolved:
ipv6: sr: fix out-of-bounds read when setting HMAC data
ghsa_unreviewed·2024-05-03
CVE-2022-48687 [MEDIUM] CWE-125 GHSA-pv89-33p5-9r7r: In the Linux kernel, the following vulnerability has been resolved:
ipv6: sr: fix out-of-bounds read when setting HMAC data
In the Linux kernel, the following vulnerability has been resolved:
ipv6: sr: fix out-of-bounds read when setting HMAC data.
The SRv6 layer allows defining HMAC data that can later be used to sign IPv6
Segment Routing Headers. This configuration is realised via netlink through
four attributes: SEG6_ATTR_HMACKEYID, SEG6_ATTR_SECRET, SEG6_ATTR_SECRETLEN and
SEG6_ATTR_ALGID. Because the SECRETLEN attribute is decoupled from the actual
length of the SECRET attribute, it is possible to provide invalid combinations
(e.g., secret = "", secretlen = 64). This case is not checked in the code and
with an appropriately crafted netlink message, an out-of-bounds read of up
to 64 bytes (max secret length) can occur past the skb end pointer and into
skb_shared_info:
Breakpoint 1, seg6_genl_sethmac (skb
OSV
CVE-2022-48687: In the Linux kernel, the following vulnerability has been resolved: ipv6: sr: fix out-of-bounds read when setting HMAC data
osv·2024-05-03·CVSS 5.5
CVE-2022-48687 [MEDIUM] CVE-2022-48687: In the Linux kernel, the following vulnerability has been resolved: ipv6: sr: fix out-of-bounds read when setting HMAC data
In the Linux kernel, the following vulnerability has been resolved: ipv6: sr: fix out-of-bounds read when setting HMAC data. The SRv6 layer allows defining HMAC data that can later be used to sign IPv6 Segment Routing Headers. This configuration is realised via netlink through four attributes: SEG6_ATTR_HMACKEYID, SEG6_ATTR_SECRET, SEG6_ATTR_SECRETLEN and SEG6_ATTR_ALGID. Because the SECRETLEN attribute is decoupled from the actual length of the SECRET attribute, it is possible to provide invalid combinations (e.g., secret = "", secretlen = 64). This case is not checked in the code and with an appropriately crafted netlink message, an out-of-bounds read of up to 64 bytes (max secret length) can occur past the skb end pointer and into skb_shared_info: Breakpoint 1, seg6_genl_sethmac (skb=,
Red Hat
kernel: ipv6: sr: fix out-of-bounds read when setting HMAC data.
vendor_redhat·2024-05-03·CVSS 5.5
CVE-2022-48687 [MEDIUM] kernel: ipv6: sr: fix out-of-bounds read when setting HMAC data.
kernel: ipv6: sr: fix out-of-bounds read when setting HMAC data.
In the Linux kernel, the following vulnerability has been resolved:
ipv6: sr: fix out-of-bounds read when setting HMAC data.
The SRv6 layer allows defining HMAC data that can later be used to sign IPv6
Segment Routing Headers. This configuration is realised via netlink through
four attributes: SEG6_ATTR_HMACKEYID, SEG6_ATTR_SECRET, SEG6_ATTR_SECRETLEN and
SEG6_ATTR_ALGID. Because the SECRETLEN attribute is decoupled from the actual
length of the SECRET attribute, it is possible to provide invalid combinations
(e.g., secret = "", secretlen = 64). This case is not checked in the code and
with an appropriately crafted netlink message, an out-of-bounds read of up
to 64 bytes (max secret length) can occur past the skb end pointer
Debian
CVE-2022-48687: linux - In the Linux kernel, the following vulnerability has been resolved: ipv6: sr: f...
vendor_debian·2022·CVSS 5.5
CVE-2022-48687 [MEDIUM] CVE-2022-48687: linux - In the Linux kernel, the following vulnerability has been resolved: ipv6: sr: f...
In the Linux kernel, the following vulnerability has been resolved: ipv6: sr: fix out-of-bounds read when setting HMAC data. The SRv6 layer allows defining HMAC data that can later be used to sign IPv6 Segment Routing Headers. This configuration is realised via netlink through four attributes: SEG6_ATTR_HMACKEYID, SEG6_ATTR_SECRET, SEG6_ATTR_SECRETLEN and SEG6_ATTR_ALGID. Because the SECRETLEN attribute is decoupled from the actual length of the SECRET attribute, it is possible to provide invalid combinations (e.g., secret = "", secretlen = 64). This case is not checked in the code and with an appropriately crafted netlink message, an out-of-bounds read of up to 64 bytes (max secret length) can occur past the skb end pointer and into skb_shared_info: Breakpoint 1, seg6_genl_sethmac (skb=,
No detection rules found.
No public exploits indexed.
https://git.kernel.org/stable/c/076f2479fc5a15c4a970ca3b5e57d42ba09a31fahttps://git.kernel.org/stable/c/3df71e11a4773d775c3633c44319f7acdb89011chttps://git.kernel.org/stable/c/55195563ec29f80f984237b743de0e2b6ba4d093https://git.kernel.org/stable/c/56ad3f475482bca55b0ae544031333018eb145b3https://git.kernel.org/stable/c/84a53580c5d2138c7361c7c3eea5b31827e63b35https://git.kernel.org/stable/c/dc9dbd65c803af1607484fed5da50d41dc8dd864https://git.kernel.org/stable/c/f684c16971ed5e77dfa25a9ad25b5297e1f58eabhttps://git.kernel.org/stable/c/076f2479fc5a15c4a970ca3b5e57d42ba09a31fahttps://git.kernel.org/stable/c/3df71e11a4773d775c3633c44319f7acdb89011chttps://git.kernel.org/stable/c/55195563ec29f80f984237b743de0e2b6ba4d093https://git.kernel.org/stable/c/56ad3f475482bca55b0ae544031333018eb145b3https://git.kernel.org/stable/c/84a53580c5d2138c7361c7c3eea5b31827e63b35https://git.kernel.org/stable/c/dc9dbd65c803af1607484fed5da50d41dc8dd864https://git.kernel.org/stable/c/f684c16971ed5e77dfa25a9ad25b5297e1f58eab
2024-05-03
Published