CVE-2022-48949
published 2024-10-21CVE-2022-48949: In the Linux kernel, the following vulnerability has been resolved: igb: Initialize mailbox message for VF reset When a MAC address is not assigned to the VF…
PriorityP422medium5.5CVSS 3.1
AVLACLPRLUINSUCHINAN
EPSS
0.25%
16.7th percentile
In the Linux kernel, the following vulnerability has been resolved:
igb: Initialize mailbox message for VF reset
When a MAC address is not assigned to the VF, that portion of the message
sent to the VF is not set. The memory, however, is allocated from the
stack meaning that information may be leaked to the VM. Initialize the
message buffer to 0 so that no information is passed to the VM in this
case.
Affected
22 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 6.1.4-1 (bookworm) | linux 6.1.4-1 (bookworm) |
| linux | linux | — | — |
| linux | linux | >= 6ddbc4cf1f4d5a3a58b4223c80881f299dae3774 < a6629659af3f5c6a91e3914ea62554c975ab77f4 | a6629659af3f5c6a91e3914ea62554c975ab77f4 |
| linux | linux | >= 6ddbc4cf1f4d5a3a58b4223c80881f299dae3774 < ef1d739dd1f362aec081278ff92f943c31eb177a | ef1d739dd1f362aec081278ff92f943c31eb177a |
| linux | linux | >= 6ddbc4cf1f4d5a3a58b4223c80881f299dae3774 < c581439a977545d61849a72e8ed631cfc8a2a3c1 | c581439a977545d61849a72e8ed631cfc8a2a3c1 |
| linux | linux | >= 6ddbc4cf1f4d5a3a58b4223c80881f299dae3774 < f2479c3daaabccbac6c343a737615d0c595c6dc4 | f2479c3daaabccbac6c343a737615d0c595c6dc4 |
| linux | linux | >= 6ddbc4cf1f4d5a3a58b4223c80881f299dae3774 < 367e1e3399dbc56fc669740c4ab60e35da632b0e | 367e1e3399dbc56fc669740c4ab60e35da632b0e |
| linux | linux | >= 6ddbc4cf1f4d5a3a58b4223c80881f299dae3774 < 51fd5ede7ed42f272682a0c33d6f0767b3484a3d | 51fd5ede7ed42f272682a0c33d6f0767b3484a3d |
| linux | linux | >= 6ddbc4cf1f4d5a3a58b4223c80881f299dae3774 < c383c7c35c7bc15e07a04eefa060a8a80cbeae29 | c383c7c35c7bc15e07a04eefa060a8a80cbeae29 |
| linux | linux | >= 6ddbc4cf1f4d5a3a58b4223c80881f299dae3774 < de5dc44370fbd6b46bd7f1a1e00369be54a041c8 | de5dc44370fbd6b46bd7f1a1e00369be54a041c8 |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | >= 0 < 5.10.162-1 | 5.10.162-1 |
| linux | linux_kernel | >= 0 < 6.1.4-1 | 6.1.4-1 |
| linux | linux_kernel | >= 0 < 6.1.4-1 | 6.1.4-1 |
| linux | linux_kernel | >= 0 < 6.1.4-1 | 6.1.4-1 |
| linux | linux_kernel | >= 4.0 < 4.14.303 | 4.14.303 |
| linux | linux_kernel | >= 4.15 < 4.19.270 | 4.19.270 |
| linux | linux_kernel | >= 4.20 < 5.4.229 | 5.4.229 |
| linux | linux_kernel | >= 5.11 < 5.15.85 | 5.15.85 |
| linux | linux_kernel | >= 5.16 < 6.0.15 | 6.0.15 |
| linux | linux_kernel | >= 5.5 < 5.10.161 | 5.10.161 |
CVSS provenance
nvdv3.15.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
osv5.5MEDIUM
vendor_debian5.5MEDIUM
vendor_redhat5.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
kernel: igb: Initialize mailbox message for VF reset
vendor_redhat·2024-10-21·CVSS 5.5
CVE-2022-48949 [MEDIUM] kernel: igb: Initialize mailbox message for VF reset
kernel: igb: Initialize mailbox message for VF reset
In the Linux kernel, the following vulnerability has been resolved:
igb: Initialize mailbox message for VF reset
When a MAC address is not assigned to the VF, that portion of the message
sent to the VF is not set. The memory, however, is allocated from the
stack meaning that information may be leaked to the VM. Initialize the
message buffer to 0 so that no information is passed to the VM in this
case.
Statement: Only small memory leak possible for specific case, so security impact is limited.
Mitigation: To mitigate this issue, prevent module igb from being loaded. Please see https://access.redhat.com/solutions/41278 for how to blacklist a kernel module to prevent it from loading automatically.
Package: kernel (Red Hat Enterprise Lin
Debian
CVE-2022-48949: linux - In the Linux kernel, the following vulnerability has been resolved: igb: Initia...
vendor_debian·2022·CVSS 5.5
CVE-2022-48949 [MEDIUM] CVE-2022-48949: linux - In the Linux kernel, the following vulnerability has been resolved: igb: Initia...
In the Linux kernel, the following vulnerability has been resolved: igb: Initialize mailbox message for VF reset When a MAC address is not assigned to the VF, that portion of the message sent to the VF is not set. The memory, however, is allocated from the stack meaning that information may be leaked to the VM. Initialize the message buffer to 0 so that no information is passed to the VM in this case.
Scope: local
bookworm: resolved (fixed in 6.1.4-1)
bullseye: resolved (fixed in 5.10.162-1)
forky: resolved (fixed in 6.1.4-1)
sid: resolved (fixed in 6.1.4-1)
trixie: resolved (fixed in 6.1.4-1)
GHSA
GHSA-2jwm-7wcx-f364: In the Linux kernel, the following vulnerability has been resolved:
igb: Initialize mailbox message for VF reset
When a MAC address is not assigned
ghsa_unreviewed·2024-10-21
CVE-2022-48949 [MEDIUM] CWE-908 GHSA-2jwm-7wcx-f364: In the Linux kernel, the following vulnerability has been resolved:
igb: Initialize mailbox message for VF reset
When a MAC address is not assigned
In the Linux kernel, the following vulnerability has been resolved:
igb: Initialize mailbox message for VF reset
When a MAC address is not assigned to the VF, that portion of the message
sent to the VF is not set. The memory, however, is allocated from the
stack meaning that information may be leaked to the VM. Initialize the
message buffer to 0 so that no information is passed to the VM in this
case.
OSV
CVE-2022-48949: In the Linux kernel, the following vulnerability has been resolved: igb: Initialize mailbox message for VF reset When a MAC address is not assigned to
osv·2024-10-21·CVSS 5.5
CVE-2022-48949 [MEDIUM] CVE-2022-48949: In the Linux kernel, the following vulnerability has been resolved: igb: Initialize mailbox message for VF reset When a MAC address is not assigned to
In the Linux kernel, the following vulnerability has been resolved: igb: Initialize mailbox message for VF reset When a MAC address is not assigned to the VF, that portion of the message sent to the VF is not set. The memory, however, is allocated from the stack meaning that information may be leaked to the VM. Initialize the message buffer to 0 so that no information is passed to the VM in this case.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://git.kernel.org/stable/c/367e1e3399dbc56fc669740c4ab60e35da632b0ehttps://git.kernel.org/stable/c/51fd5ede7ed42f272682a0c33d6f0767b3484a3dhttps://git.kernel.org/stable/c/a6629659af3f5c6a91e3914ea62554c975ab77f4https://git.kernel.org/stable/c/c383c7c35c7bc15e07a04eefa060a8a80cbeae29https://git.kernel.org/stable/c/c581439a977545d61849a72e8ed631cfc8a2a3c1https://git.kernel.org/stable/c/de5dc44370fbd6b46bd7f1a1e00369be54a041c8https://git.kernel.org/stable/c/ef1d739dd1f362aec081278ff92f943c31eb177ahttps://git.kernel.org/stable/c/f2479c3daaabccbac6c343a737615d0c595c6dc4
2024-10-21
Published