cbcvebase.
CVE-2022-49092
published 2025-02-26

CVE-2022-49092: In the Linux kernel, the following vulnerability has been resolved: net: ipv4: fix route with nexthop object delete warning FRR folks have hit a kernel…

PriorityP420medium5.5CVSS 3.1
AVLACLPRLUINSUCNINAH
EPSS
0.27%
19.3th percentile
In the Linux kernel, the following vulnerability has been resolved: net: ipv4: fix route with nexthop object delete warning FRR folks have hit a kernel warning[1] while deleting routes[2] which is caused by trying to delete a route pointing to a nexthop id without specifying nhid but matching on an interface. That is, a route is found but we hit a warning while matching it. The warning is from fib_info_nh() in include/net/nexthop.h because we run it on a fib_info with nexthop object. The call chain is: inet_rtm_delroute -> fib_table_delete -> fib_nh_match (called with a nexthop fib_info and also with fc_oif set thus calling fib_info_nh on the fib_info and triggering the warning). The fix is to not do any matching in that branch if the fi has a nexthop object because those are managed separately. I.e. we should match when deleting without nh spec and should fail when deleting a nexthop route with old-style nh spec because nexthop objects are managed separately, e.g.: $ ip r show 1.2.3.4/32 1.2.3.4 nhid 12 via 192.168.11.2 dev dummy0 $ ip r del 1.2.3.4/32 $ ip r del 1.2.3.4/32 nhid 12 $ ip r del 1.2.3.4/32 dev dummy0 [1] [ 523.462226] ------------[ cut here ]------------ [ 523.462230] WARNING: CPU: 14 PID: 22893 at include/net/nexthop.h:468 fib_nh_match+0x210/0x460 [ 523.462236] Modules linked in: dummy rpcsec_gss_krb5 xt_socket nf_socket_ipv4 nf_socket_ipv6 ip6table_raw iptable_raw bpf_preload xt_statistic ip_set ip_vs_sh ip_vs_wrr ip_vs_rr ip_vs xt_mark nf_tables xt_nat veth nf_conntrack_netlink nfnetlink xt_addrtype br_netfilter overlay dm_crypt nfsv3 nfs fscache netfs vhost_net vhost vhost_iotlb tap tun xt_CHECKSUM xt_MASQUERADE xt_conntrack 8021q garp mrp ipt_REJECT nf_reject_ipv4 ip6table_mangle ip6table_nat iptable_mangle iptable_nat nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 iptable_filter bridge stp llc rfcomm snd_seq_dummy snd_hrtimer rpcrdma rdma_cm iw_cm ib_cm ib_core ip6table_filter xt_comment ip6_tables vboxnetadp(OE) vboxnetflt(OE) vboxdrv

Affected

18 ranges
VendorProductVersion rangeFixed in
debianlinux< linux 5.17.3-1 (bookworm)linux 5.17.3-1 (bookworm)
linuxlinux——
linuxlinux>= 4c7e8084fd467ddb2b0e6c6011f9c1064afb7e56 < f5064531c23ad646da7be8b938292b00a7e61438f5064531c23ad646da7be8b938292b00a7e61438
linuxlinux>= 4c7e8084fd467ddb2b0e6c6011f9c1064afb7e56 < 63ea57478aaa3e06a597081a0f537318fc04e49f63ea57478aaa3e06a597081a0f537318fc04e49f
linuxlinux>= 4c7e8084fd467ddb2b0e6c6011f9c1064afb7e56 < 907c97986d6fa77318d17659dd76c94b65dd27c5907c97986d6fa77318d17659dd76c94b65dd27c5
linuxlinux>= 4c7e8084fd467ddb2b0e6c6011f9c1064afb7e56 < dcd689f9e2640c992f94eae9955b106f71c6825ddcd689f9e2640c992f94eae9955b106f71c6825d
linuxlinux>= 4c7e8084fd467ddb2b0e6c6011f9c1064afb7e56 < f8db5743d09523c0bb35f16e13691e3b7eb5dba0f8db5743d09523c0bb35f16e13691e3b7eb5dba0
linuxlinux>= 4c7e8084fd467ddb2b0e6c6011f9c1064afb7e56 < 6bf92d70e690b7ff12b24f4bfff5e5434d019b826bf92d70e690b7ff12b24f4bfff5e5434d019b82
linuxlinux_kernel——
linuxlinux_kernel>= 0 < 5.10.113-15.10.113-1
linuxlinux_kernel>= 0 < 5.17.3-15.17.3-1
linuxlinux_kernel>= 0 < 5.17.3-15.17.3-1
linuxlinux_kernel>= 0 < 5.17.3-15.17.3-1
linuxlinux_kernel>= 5.11 < 5.15.345.15.34
linuxlinux_kernel>= 5.16 < 5.16.205.16.20
linuxlinux_kernel>= 5.17 < 5.17.35.17.3
linuxlinux_kernel>= 5.3 < 5.4.1895.4.189
linuxlinux_kernel>= 5.5 < 5.10.1115.10.111

CVSS provenance

nvdv3.15.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
osv5.5MEDIUM
vendor_debian5.5MEDIUM
vendor_redhat5.5MEDIUM
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.