CVE-2022-49577
published 2025-02-26CVE-2022-49577: In the Linux kernel, the following vulnerability has been resolved: udp: Fix a data-race around sysctl_udp_l3mdev_accept. While reading…
PriorityP414medium4.7CVSS 3.1
AVLACHPRLUINSUCNINAH
EPSS
0.18%
8.4th percentile
In the Linux kernel, the following vulnerability has been resolved:
udp: Fix a data-race around sysctl_udp_l3mdev_accept.
While reading sysctl_udp_l3mdev_accept, it can be changed concurrently.
Thus, we need to add READ_ONCE() to its reader.
Affected
16 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 5.18.16-1 (bookworm) | linux 5.18.16-1 (bookworm) |
| linux | linux | — | — |
| linux | linux | >= 63a6fff353d01da5a22b72670c434bf12fa0e3b8 < f39b03bd727a8fea62e82f10fe2e0d753b9930ff | f39b03bd727a8fea62e82f10fe2e0d753b9930ff |
| linux | linux | >= 63a6fff353d01da5a22b72670c434bf12fa0e3b8 < fcaef69c79ec222e55643e666b80b221e70fa6a8 | fcaef69c79ec222e55643e666b80b221e70fa6a8 |
| linux | linux | >= 63a6fff353d01da5a22b72670c434bf12fa0e3b8 < 3f2ac2d6511bb0652abf4d7388d65bb9ff1c641c | 3f2ac2d6511bb0652abf4d7388d65bb9ff1c641c |
| linux | linux | >= 63a6fff353d01da5a22b72670c434bf12fa0e3b8 < cb0d28934ca10f99c47e2c6f451405d6c954fe48 | cb0d28934ca10f99c47e2c6f451405d6c954fe48 |
| linux | linux | >= 63a6fff353d01da5a22b72670c434bf12fa0e3b8 < 3d72bb4188c708bb16758c60822fc4dda7a95174 | 3d72bb4188c708bb16758c60822fc4dda7a95174 |
| linux | linux_kernel | — | — |
| linux | linux_kernel | >= 0 < 5.10.136-1 | 5.10.136-1 |
| linux | linux_kernel | >= 0 < 5.18.16-1 | 5.18.16-1 |
| linux | linux_kernel | >= 0 < 5.18.16-1 | 5.18.16-1 |
| linux | linux_kernel | >= 0 < 5.18.16-1 | 5.18.16-1 |
| linux | linux_kernel | >= 4.11 < 5.4.208 | 5.4.208 |
| linux | linux_kernel | >= 5.11 < 5.15.58 | 5.15.58 |
| linux | linux_kernel | >= 5.16 < 5.18.15 | 5.18.15 |
| linux | linux_kernel | >= 5.5 < 5.10.134 | 5.10.134 |
CVSS provenance
nvdv3.14.7MEDIUMCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
osv4.7MEDIUM
vendor_debian4.7MEDIUM
vendor_redhat4.7MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
kernel: udp: Fix a data-race around sysctl_udp_l3mdev_accept.
vendor_redhat·2025-02-26·CVSS 4.7
CVE-2022-49577 [MEDIUM] CWE-362 kernel: udp: Fix a data-race around sysctl_udp_l3mdev_accept.
kernel: udp: Fix a data-race around sysctl_udp_l3mdev_accept.
In the Linux kernel, the following vulnerability has been resolved:
udp: Fix a data-race around sysctl_udp_l3mdev_accept.
While reading sysctl_udp_l3mdev_accept, it can be changed concurrently.
Thus, we need to add READ_ONCE() to its reader.
Statement: The bug is that during reading of the variable net->ipv4.sysctl_udp_l3mdev_accept potentially could read incorrect value if race happens (if simultaneously value of this variable being changed). Since corruption could happen only during reading and value of variable itself not corrupted and very complex or impossible to trigger the bug, the security impact is limited. Only root user or other privileged user can change value of this variable.
Package: kernel (Red Hat Enterprise
Debian
CVE-2022-49577: linux - In the Linux kernel, the following vulnerability has been resolved: udp: Fix a ...
vendor_debian·2022·CVSS 4.7
CVE-2022-49577 [MEDIUM] CVE-2022-49577: linux - In the Linux kernel, the following vulnerability has been resolved: udp: Fix a ...
In the Linux kernel, the following vulnerability has been resolved: udp: Fix a data-race around sysctl_udp_l3mdev_accept. While reading sysctl_udp_l3mdev_accept, it can be changed concurrently. Thus, we need to add READ_ONCE() to its reader.
Scope: local
bookworm: resolved (fixed in 5.18.16-1)
bullseye: resolved (fixed in 5.10.136-1)
forky: resolved (fixed in 5.18.16-1)
sid: resolved (fixed in 5.18.16-1)
trixie: resolved (fixed in 5.18.16-1)
GHSA
GHSA-8vfx-6h25-h9h3: In the Linux kernel, the following vulnerability has been resolved:
udp: Fix a data-race around sysctl_udp_l3mdev_accept
ghsa_unreviewed·2025-03-10
CVE-2022-49577 [MEDIUM] CWE-362 GHSA-8vfx-6h25-h9h3: In the Linux kernel, the following vulnerability has been resolved:
udp: Fix a data-race around sysctl_udp_l3mdev_accept
In the Linux kernel, the following vulnerability has been resolved:
udp: Fix a data-race around sysctl_udp_l3mdev_accept.
While reading sysctl_udp_l3mdev_accept, it can be changed concurrently.
Thus, we need to add READ_ONCE() to its reader.
OSV
CVE-2022-49577: In the Linux kernel, the following vulnerability has been resolved: udp: Fix a data-race around sysctl_udp_l3mdev_accept
osv·2025-02-26·CVSS 4.7
CVE-2022-49577 [MEDIUM] CVE-2022-49577: In the Linux kernel, the following vulnerability has been resolved: udp: Fix a data-race around sysctl_udp_l3mdev_accept
In the Linux kernel, the following vulnerability has been resolved: udp: Fix a data-race around sysctl_udp_l3mdev_accept. While reading sysctl_udp_l3mdev_accept, it can be changed concurrently. Thus, we need to add READ_ONCE() to its reader.
No detection rules found.
No public exploits indexed.
https://git.kernel.org/stable/c/3d72bb4188c708bb16758c60822fc4dda7a95174https://git.kernel.org/stable/c/3f2ac2d6511bb0652abf4d7388d65bb9ff1c641chttps://git.kernel.org/stable/c/cb0d28934ca10f99c47e2c6f451405d6c954fe48https://git.kernel.org/stable/c/f39b03bd727a8fea62e82f10fe2e0d753b9930ffhttps://git.kernel.org/stable/c/fcaef69c79ec222e55643e666b80b221e70fa6a8
2025-02-26
Published