CVE-2022-48839
published 2024-07-16CVE-2022-48839: In the Linux kernel, the following vulnerability has been resolved: net/packet: fix slab-out-of-bounds access in packet_recvmsg() syzbot found that when an…
PriorityP423medium5.5CVSS 3.1
AVLACLPRLUINSUCNINAH
EPSS
0.27%
18.7th percentile
In the Linux kernel, the following vulnerability has been resolved:
net/packet: fix slab-out-of-bounds access in packet_recvmsg()
syzbot found that when an AF_PACKET socket is using PACKET_COPY_THRESH
and mmap operations, tpacket_rcv() is queueing skbs with
garbage in skb->cb[], triggering a too big copy [1]
Presumably, users of af_packet using mmap() already gets correct
metadata from the mapped buffer, we can simply make sure
to clear 12 bytes that might be copied to user space later.
BUG: KASAN: stack-out-of-bounds in memcpy include/linux/fortify-string.h:225 [inline]
BUG: KASAN: stack-out-of-bounds in packet_recvmsg+0x56c/0x1150 net/packet/af_packet.c:3489
Write of size 165 at addr ffffc9000385fb78 by task syz-executor233/3631
CPU: 0 PID: 3631 Comm: syz-executor233 Not tainted 5.17.0-rc7-syzkaller-02396-g0b3660695e80 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106
print_address_description.constprop.0.cold+0xf/0x336 mm/kasan/report.c:255
__kasan_report mm/kasan/report.c:442 [inline]
kasan_report.cold+0x83/0xdf mm/kasan/report.c:459
check_region_inline mm/kasan/generic.c:183 [inline]
kasan_check_range+0x13d/0x180 mm/kasan/generic.c:189
memcpy+0x39/0x60 mm/kasan/shadow.c:66
memcpy include/linux/fortify-string.h:225 [inline]
packet_recvmsg+0x56c/0x1150 net/packet/af_packet.c:3489
sock_recvmsg_nosec net/socket.c:948 [inline]
sock_recvmsg net/socket.c:966 [inline]
sock_recvmsg net/socket.c:962 [inline]
____sys_recvmsg+0x2c4/0x600 net/socket.c:2632
___sys_recvmsg+0x127/0x200 net/socket.c:2674
__sys_recvmsg+0xe2/0x1a0 net/socket.c:2704
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x44/0xae
RIP: 0033:0x7fdfd5954c29
Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 41 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 2
Affected
21 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 5.17.3-1 (bookworm) | linux 5.17.3-1 (bookworm) |
| linux | linux | — | — |
| linux | linux | >= 0fb375fb9b93b7d822debc6a734052337ccfdb1f < b9d5772d60f8e7ef34e290f72fc20e3a4883e7d0 | b9d5772d60f8e7ef34e290f72fc20e3a4883e7d0 |
| linux | linux | >= 0fb375fb9b93b7d822debc6a734052337ccfdb1f < b1e27cda1e3c12b705875bb7e247a97168580e33 | b1e27cda1e3c12b705875bb7e247a97168580e33 |
| linux | linux | >= 0fb375fb9b93b7d822debc6a734052337ccfdb1f < a33dd1e6693f80d805155b3f69c18c2f642915da | a33dd1e6693f80d805155b3f69c18c2f642915da |
| linux | linux | >= 0fb375fb9b93b7d822debc6a734052337ccfdb1f < 268dcf1f7b3193bc446ec3d14e08a240e9561e4d | 268dcf1f7b3193bc446ec3d14e08a240e9561e4d |
| linux | linux | >= 0fb375fb9b93b7d822debc6a734052337ccfdb1f < 70b7b3c055fd4a464da8da55ff4c1f84269f9b02 | 70b7b3c055fd4a464da8da55ff4c1f84269f9b02 |
| linux | linux | >= 0fb375fb9b93b7d822debc6a734052337ccfdb1f < a055f5f2841f7522b44a2b1eccb1951b4b03d51a | a055f5f2841f7522b44a2b1eccb1951b4b03d51a |
| linux | linux | >= 0fb375fb9b93b7d822debc6a734052337ccfdb1f < ef591b35176029fdefea38e8388ffa371e18f4b2 | ef591b35176029fdefea38e8388ffa371e18f4b2 |
| linux | linux | >= 0fb375fb9b93b7d822debc6a734052337ccfdb1f < c700525fcc06b05adfea78039de02628af79e07a | c700525fcc06b05adfea78039de02628af79e07a |
| linux | linux_kernel | >= 0 < 5.10.113-1 | 5.10.113-1 |
| linux | linux_kernel | >= 0 < 5.17.3-1 | 5.17.3-1 |
| linux | linux_kernel | >= 0 < 5.17.3-1 | 5.17.3-1 |
| linux | linux_kernel | >= 0 < 5.17.3-1 | 5.17.3-1 |
| linux | linux_kernel | >= 2.6.14 < 4.9.308 | 4.9.308 |
| linux | linux_kernel | >= 4.10 < 4.14.273 | 4.14.273 |
| linux | linux_kernel | >= 4.15 < 4.19.236 | 4.19.236 |
| linux | linux_kernel | >= 4.20 < 5.4.187 | 5.4.187 |
| linux | linux_kernel | >= 5.11 < 5.15.31 | 5.15.31 |
| linux | linux_kernel | >= 5.16 < 5.16.17 | 5.16.17 |
| linux | linux_kernel | >= 5.5 < 5.10.108 | 5.10.108 |
CVSS provenance
nvdv3.15.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
osv5.5MEDIUM
vendor_debian5.5MEDIUM
vendor_redhat5.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
CVE-2022-48839: In the Linux kernel, the following vulnerability has been resolved: net/packet: fix slab-out-of-bounds access in packet_recvmsg() syzbot found that wh
osv·2024-07-16·CVSS 5.5
CVE-2022-48839 [MEDIUM] CVE-2022-48839: In the Linux kernel, the following vulnerability has been resolved: net/packet: fix slab-out-of-bounds access in packet_recvmsg() syzbot found that wh
In the Linux kernel, the following vulnerability has been resolved: net/packet: fix slab-out-of-bounds access in packet_recvmsg() syzbot found that when an AF_PACKET socket is using PACKET_COPY_THRESH and mmap operations, tpacket_rcv() is queueing skbs with garbage in skb->cb[], triggering a too big copy [1] Presumably, users of af_packet using mmap() already gets correct metadata from the mapped buffer, we can simply make sure to clear 12 bytes that might be copied to user space later. BUG: KASAN: stack-out-of-bounds in memcpy include/linux/fortify-string.h:225 [inline] BUG: KASAN: stack-out-of-bounds in packet_recvmsg+0x56c/0x1150 net/packet/af_packet.c:3489 Write of size 165 at addr ffffc9000385fb78 by task syz-executor233/3631 CPU: 0 PID: 3631 Comm: syz-executor233 Not tainted 5.17.0-r
GHSA
GHSA-qvwc-r3r6-hq25: In the Linux kernel, the following vulnerability has been resolved:
net/packet: fix slab-out-of-bounds access in packet_recvmsg()
syzbot found that
ghsa_unreviewed·2024-07-16
CVE-2022-48839 [MEDIUM] CWE-125 GHSA-qvwc-r3r6-hq25: In the Linux kernel, the following vulnerability has been resolved:
net/packet: fix slab-out-of-bounds access in packet_recvmsg()
syzbot found that
In the Linux kernel, the following vulnerability has been resolved:
net/packet: fix slab-out-of-bounds access in packet_recvmsg()
syzbot found that when an AF_PACKET socket is using PACKET_COPY_THRESH
and mmap operations, tpacket_rcv() is queueing skbs with
garbage in skb->cb[], triggering a too big copy [1]
Presumably, users of af_packet using mmap() already gets correct
metadata from the mapped buffer, we can simply make sure
to clear 12 bytes that might be copied to user space later.
BUG: KASAN: stack-out-of-bounds in memcpy include/linux/fortify-string.h:225 [inline]
BUG: KASAN: stack-out-of-bounds in packet_recvmsg+0x56c/0x1150 net/packet/af_packet.c:3489
Write of size 165 at addr ffffc9000385fb78 by task syz-executor233/3631
CPU: 0 PID: 3631 Comm: syz-executor233 Not tainted 5.1
Red Hat
kernel: net/packet: fix slab-out-of-bounds access in packet_recvmsg()
vendor_redhat·2024-07-16·CVSS 5.5
CVE-2022-48839 [MEDIUM] CWE-125 kernel: net/packet: fix slab-out-of-bounds access in packet_recvmsg()
kernel: net/packet: fix slab-out-of-bounds access in packet_recvmsg()
In the Linux kernel, the following vulnerability has been resolved:
net/packet: fix slab-out-of-bounds access in packet_recvmsg()
syzbot found that when an AF_PACKET socket is using PACKET_COPY_THRESH
and mmap operations, tpacket_rcv() is queueing skbs with
garbage in skb->cb[], triggering a too big copy [1]
Presumably, users of af_packet using mmap() already gets correct
metadata from the mapped buffer, we can simply make sure
to clear 12 bytes that might be copied to user space later.
BUG: KASAN: stack-out-of-bounds in memcpy include/linux/fortify-string.h:225 [inline]
BUG: KASAN: stack-out-of-bounds in packet_recvmsg+0x56c/0x1150 net/packet/af_packet.c:3489
Write of size 165 at addr ffffc9000385fb78 by task syz-execu
Debian
CVE-2022-48839: linux - In the Linux kernel, the following vulnerability has been resolved: net/packet:...
vendor_debian·2022·CVSS 5.5
CVE-2022-48839 [MEDIUM] CVE-2022-48839: linux - In the Linux kernel, the following vulnerability has been resolved: net/packet:...
In the Linux kernel, the following vulnerability has been resolved: net/packet: fix slab-out-of-bounds access in packet_recvmsg() syzbot found that when an AF_PACKET socket is using PACKET_COPY_THRESH and mmap operations, tpacket_rcv() is queueing skbs with garbage in skb->cb[], triggering a too big copy [1] Presumably, users of af_packet using mmap() already gets correct metadata from the mapped buffer, we can simply make sure to clear 12 bytes that might be copied to user space later. BUG: KASAN: stack-out-of-bounds in memcpy include/linux/fortify-string.h:225 [inline] BUG: KASAN: stack-out-of-bounds in packet_recvmsg+0x56c/0x1150 net/packet/af_packet.c:3489 Write of size 165 at addr ffffc9000385fb78 by task syz-executor233/3631 CPU: 0 PID: 3631 Comm: syz-executor233 Not tainted 5.17.0-r
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://git.kernel.org/stable/c/268dcf1f7b3193bc446ec3d14e08a240e9561e4dhttps://git.kernel.org/stable/c/70b7b3c055fd4a464da8da55ff4c1f84269f9b02https://git.kernel.org/stable/c/a055f5f2841f7522b44a2b1eccb1951b4b03d51ahttps://git.kernel.org/stable/c/a33dd1e6693f80d805155b3f69c18c2f642915dahttps://git.kernel.org/stable/c/b1e27cda1e3c12b705875bb7e247a97168580e33https://git.kernel.org/stable/c/b9d5772d60f8e7ef34e290f72fc20e3a4883e7d0https://git.kernel.org/stable/c/c700525fcc06b05adfea78039de02628af79e07ahttps://git.kernel.org/stable/c/ef591b35176029fdefea38e8388ffa371e18f4b2https://git.kernel.org/stable/c/268dcf1f7b3193bc446ec3d14e08a240e9561e4dhttps://git.kernel.org/stable/c/70b7b3c055fd4a464da8da55ff4c1f84269f9b02https://git.kernel.org/stable/c/a055f5f2841f7522b44a2b1eccb1951b4b03d51ahttps://git.kernel.org/stable/c/a33dd1e6693f80d805155b3f69c18c2f642915dahttps://git.kernel.org/stable/c/b1e27cda1e3c12b705875bb7e247a97168580e33https://git.kernel.org/stable/c/b9d5772d60f8e7ef34e290f72fc20e3a4883e7d0https://git.kernel.org/stable/c/c700525fcc06b05adfea78039de02628af79e07ahttps://git.kernel.org/stable/c/ef591b35176029fdefea38e8388ffa371e18f4b2
2024-07-16
Published