Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2022-48839— net/packet: fix slab-out-of-bounds access in packet_recvmsg()

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel 存在安全漏洞，该漏洞源于net/packet模块中发现堆越界访问问题。在使用PACKET_COPY_THRESH和mmap操作时，tpacket_rcv函数可能将包含垃圾数据的skb排队。

CVSS 7.8 · High EPSS 0.27% · P18

Affected Version Matrix 18

VendorProduct Version RangeStatus
Linux Linux 0fb375fb9b93b7d822debc6a734052337ccfdb1f< b9d5772d60f8e7ef34e290f72fc20e3a4883e7d0 affected
0fb375fb9b93b7d822debc6a734052337ccfdb1f< b1e27cda1e3c12b705875bb7e247a97168580e33 affected
0fb375fb9b93b7d822debc6a734052337ccfdb1f< a33dd1e6693f80d805155b3f69c18c2f642915da affected
0fb375fb9b93b7d822debc6a734052337ccfdb1f< 268dcf1f7b3193bc446ec3d14e08a240e9561e4d affected
0fb375fb9b93b7d822debc6a734052337ccfdb1f< 70b7b3c055fd4a464da8da55ff4c1f84269f9b02 affected
0fb375fb9b93b7d822debc6a734052337ccfdb1f< a055f5f2841f7522b44a2b1eccb1951b4b03d51a affected
0fb375fb9b93b7d822debc6a734052337ccfdb1f< ef591b35176029fdefea38e8388ffa371e18f4b2 affected
0fb375fb9b93b7d822debc6a734052337ccfdb1f< c700525fcc06b05adfea78039de02628af79e07a affected
… +10 more rows
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2022-48839

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
net/packet: fix slab-out-of-bounds access in packet_recvmsg()
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: net/packet: fix slab-out-of-bounds access in packet_recvmsg() syzbot found that when an AF_PACKET socket is using PACKET_COPY_THRESH and mmap operations, tpacket_rcv() is queueing skbs with garbage in skb->cb[], triggering a too big copy [1] Presumably, users of af_packet using mmap() already gets correct metadata from the mapped buffer, we can simply make sure to clear 12 bytes that might be copied to user space later. BUG: KASAN: stack-out-of-bounds in memcpy include/linux/fortify-string.h:225 [inline] BUG: KASAN: stack-out-of-bounds in packet_recvmsg+0x56c/0x1150 net/packet/af_packet.c:3489 Write of size 165 at addr ffffc9000385fb78 by task syz-executor233/3631 CPU: 0 PID: 3631 Comm: syz-executor233 Not tainted 5.17.0-rc7-syzkaller-02396-g0b3660695e80 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106 print_address_description.constprop.0.cold+0xf/0x336 mm/kasan/report.c:255 __kasan_report mm/kasan/report.c:442 [inline] kasan_report.cold+0x83/0xdf mm/kasan/report.c:459 check_region_inline mm/kasan/generic.c:183 [inline] kasan_check_range+0x13d/0x180 mm/kasan/generic.c:189 memcpy+0x39/0x60 mm/kasan/shadow.c:66 memcpy include/linux/fortify-string.h:225 [inline] packet_recvmsg+0x56c/0x1150 net/packet/af_packet.c:3489 sock_recvmsg_nosec net/socket.c:948 [inline] sock_recvmsg net/socket.c:966 [inline] sock_recvmsg net/socket.c:962 [inline] ____sys_recvmsg+0x2c4/0x600 net/socket.c:2632 ___sys_recvmsg+0x127/0x200 net/socket.c:2674 __sys_recvmsg+0xe2/0x1a0 net/socket.c:2704 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x44/0xae RIP: 0033:0x7fdfd5954c29 Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 41 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007ffcf8e71e48 EFLAGS: 00000246 ORIG_RAX: 000000000000002f RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fdfd5954c29 RDX: 0000000000000000 RSI: 0000000020000500 RDI: 0000000000000005 RBP: 0000000000000000 R08: 000000000000000d R09: 000000000000000d R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffcf8e71e60 R13: 00000000000f4240 R14: 000000000000c1ff R15: 00007ffcf8e71e54 </TASK> addr ffffc9000385fb78 is located in stack of task syz-executor233/3631 at offset 32 in frame: ____sys_recvmsg+0x0/0x600 include/linux/uio.h:246 this frame has 1 object: [32, 160) 'addr' Memory state around the buggy address: ffffc9000385fa80: 00 04 f3 f3 f3 f3 f3 00 00 00 00 00 00 00 00 00 ffffc9000385fb00: 00 00 00 00 00 00 00 00 00 00 00 f1 f1 f1 f1 00 >ffffc9000385fb80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f3 ^ ffffc9000385fc00: f3 f3 f3 00 00 00 00 00 00 00 00 00 00 00 00 f1 ffffc9000385fc80: f1 f1 f1 00 f2 f2 f2 00 f2 f2 f2 00 00 00 00 00 ==================================================================
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel 存在安全漏洞，该漏洞源于net/packet模块中发现堆越界访问问题。在使用PACKET_COPY_THRESH和mmap操作时，tpacket_rcv函数可能将包含垃圾数据的skb排队。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux 0fb375fb9b93b7d822debc6a734052337ccfdb1f ~ b9d5772d60f8e7ef34e290f72fc20e3a4883e7d0 -
Linux Linux 2.6.14 -

II. Public POCs for CVE-2022-48839

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2022-48839

请登录查看更多情报信息。

Other References for CVE-2022-48839 (7)

Same Patch Batch · Linux · 2024-07-16 · 98 CVEs total

CVE-2022-48788 9.8 CRITICAL nvme-rdma: fix possible use-after-free in transport error_recovery work
CVE-2022-48789 9.8 CRITICAL nvme-tcp: fix possible use-after-free in transport error_recovery work
CVE-2022-48790 9.8 CRITICAL nvme: fix a possible use-after-free in controller reset during load
CVE-2022-48851 9.8 CRITICAL staging: gdm724x: fix use after free in gdm_lte_rx()
CVE-2022-48829 9.1 CRITICAL NFSD: Fix NFSv3 SETATTR/CREATE's handling of large file sizes
CVE-2022-48828 9.1 CRITICAL NFSD: Fix ia_size underflow
CVE-2022-48864 8.8 HIGH vdpa/mlx5: add validation for VIRTIO_NET_CTRL_MQ_VQ_PAIRS_SET command
CVE-2022-48830 8.8 HIGH can: isotp: fix potential CAN frame reception race in isotp_rcv()
CVE-2022-48785 8.8 HIGH ipv6: mcast: use rcu-safe version of ipv6_get_lladdr()
CVE-2022-48782 8.8 HIGH mctp: fix use after free
CVE-2022-48796 7.8 HIGH iommu: Fix potential use-after-free during probe
CVE-2022-48786 7.8 HIGH vsock: remove vsock from connected table when connect is interrupted by a signal
CVE-2022-48791 7.8 HIGH scsi: pm8001: Fix use-after-free for aborted TMF sas_task
CVE-2022-48792 7.8 HIGH scsi: pm8001: Fix use-after-free for aborted SSP/STP sas_task
CVE-2024-41008 7.8 HIGH drm/amdgpu: change vm->task_info handling
CVE-2022-48847 7.8 HIGH watch_queue: Fix filter limit check
CVE-2022-48801 7.8 HIGH iio: buffer: Fix file related error handling in IIO_BUFFER_GET_FD_IOCTL
CVE-2022-48816 7.8 HIGH SUNRPC: lock against ->sock changing during sysfs read
CVE-2022-48821 7.8 HIGH misc: fastrpc: avoid double fput() on failed usercopy
CVE-2022-48822 7.8 HIGH usb: f_fs: Fix use-after-free for epfile

Showing top 20 of 98 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2022-48839

No comments yet

Leave a comment