cbcvebase.
CVE-2022-48912
published 2024-08-22

CVE-2022-48912: In the Linux kernel, the following vulnerability has been resolved: netfilter: fix use-after-free in __nf_register_net_hook() We must not dereference…

PriorityP339high7.8CVSS 3.1
AVLACLPRLUINSUCHIHAH
EPSS
0.23%
13.6th percentile
In the Linux kernel, the following vulnerability has been resolved: netfilter: fix use-after-free in __nf_register_net_hook() We must not dereference @new_hooks after nf_hook_mutex has been released, because other threads might have freed our allocated hooks already. BUG: KASAN: use-after-free in nf_hook_entries_get_hook_ops include/linux/netfilter.h:130 [inline] BUG: KASAN: use-after-free in hooks_validate net/netfilter/core.c:171 [inline] BUG: KASAN: use-after-free in __nf_register_net_hook+0x77a/0x820 net/netfilter/core.c:438 Read of size 2 at addr ffff88801c1a8000 by task syz-executor237/4430 CPU: 1 PID: 4430 Comm: syz-executor237 Not tainted 5.17.0-rc5-syzkaller-00306-g2293be58d6a1 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106 print_address_description.constprop.0.cold+0x8d/0x336 mm/kasan/report.c:255 __kasan_report mm/kasan/report.c:442 [inline] kasan_report.cold+0x83/0xdf mm/kasan/report.c:459 nf_hook_entries_get_hook_ops include/linux/netfilter.h:130 [inline] hooks_validate net/netfilter/core.c:171 [inline] __nf_register_net_hook+0x77a/0x820 net/netfilter/core.c:438 nf_register_net_hook+0x114/0x170 net/netfilter/core.c:571 nf_register_net_hooks+0x59/0xc0 net/netfilter/core.c:587 nf_synproxy_ipv6_init+0x85/0xe0 net/netfilter/nf_synproxy_core.c:1218 synproxy_tg6_check+0x30d/0x560 net/ipv6/netfilter/ip6t_SYNPROXY.c:81 xt_check_target+0x26c/0x9e0 net/netfilter/x_tables.c:1038 check_target net/ipv6/netfilter/ip6_tables.c:530 [inline] find_check_entry.constprop.0+0x7f1/0x9e0 net/ipv6/netfilter/ip6_tables.c:573 translate_table+0xc8b/0x1750 net/ipv6/netfilter/ip6_tables.c:735 do_replace net/ipv6/netfilter/ip6_tables.c:1153 [inline] do_ip6t_set_ctl+0x56e/0xb90 net/ipv6/netfilter/ip6_tables.c:1639 nf_setsockopt+0x83/0xe0 net/netfilter/nf_sockopt.c:101 ipv6_setsockopt+0x122/0x180 net/ipv6/ipv6_sockglue.c:1024 rawv6_set

Affected

19 ranges
VendorProductVersion rangeFixed in
debianlinux< linux 5.16.14-1 (bookworm)linux 5.16.14-1 (bookworm)
linuxlinux——
linuxlinux>= 2420b79f8c18a75ee2417cace381f4604b9b4365 < 05f7927b25d2635e87267ff6c79db79fb46cf31305f7927b25d2635e87267ff6c79db79fb46cf313
linuxlinux>= 2420b79f8c18a75ee2417cace381f4604b9b4365 < bdd8fc1b826e6f23963f5bef3f7431c6188ec954bdd8fc1b826e6f23963f5bef3f7431c6188ec954
linuxlinux>= 2420b79f8c18a75ee2417cace381f4604b9b4365 < 49c24579cec41e32f13d57b337fd28fb208d4a5b49c24579cec41e32f13d57b337fd28fb208d4a5b
linuxlinux>= 2420b79f8c18a75ee2417cace381f4604b9b4365 < 8b0142c4143c1ca297dcf2c0cdd045d65dae23448b0142c4143c1ca297dcf2c0cdd045d65dae2344
linuxlinux>= 2420b79f8c18a75ee2417cace381f4604b9b4365 < bd61f192a339b1095dfd6d56073a5265934c2979bd61f192a339b1095dfd6d56073a5265934c2979
linuxlinux>= 2420b79f8c18a75ee2417cace381f4604b9b4365 < 5a8076e98dde17224dd47283b894a8b1dbe1bc725a8076e98dde17224dd47283b894a8b1dbe1bc72
linuxlinux>= 2420b79f8c18a75ee2417cace381f4604b9b4365 < 56763f12b0f02706576a088e85ef856deacc98a056763f12b0f02706576a088e85ef856deacc98a0
linuxlinux_kernel>= 0 < 5.10.106-15.10.106-1
linuxlinux_kernel>= 0 < 5.16.14-15.16.14-1
linuxlinux_kernel>= 0 < 5.16.14-15.16.14-1
linuxlinux_kernel>= 0 < 5.16.14-15.16.14-1
linuxlinux_kernel>= 4.14 < 4.14.2704.14.270
linuxlinux_kernel>= 4.15 < 4.19.2334.19.233
linuxlinux_kernel>= 4.20 < 5.4.1835.4.183
linuxlinux_kernel>= 5.11 < 5.15.275.15.27
linuxlinux_kernel>= 5.16 < 5.16.135.16.13
linuxlinux_kernel>= 5.5 < 5.10.1045.10.104

CVSS provenance

nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
osv7.8HIGH
vendor_debian7.8HIGH
vendor_redhat7.8HIGH
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.