Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2022-48938— CDC-NCM: avoid overflow in sanity checking

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在输入验证错误漏洞，该漏洞源于在进行完整性检查时存在整数溢出问题。

AI Predicted 5.3 Difficulty: Hard EPSS 0.21% · P11

Affected Version Matrix 18

VendorProduct Version RangeStatus
Linux Linux 4ca8b8855264cf1439cdab3da7049bd1e3c2a9e6< a612395c7631918e0e10ea48b9ce5ab4340f26a6 affected
a270ca35a9499b58366d696d3290eaa4697a42db< 9957fbf34f52a4d8945d1bf39aae400ef9a11246 affected
0fa81b304a7973a499f844176ca031109487dd31< 69560efa001397ebb8dc1c3e6a3ce00302bb9f7f affected
0fa81b304a7973a499f844176ca031109487dd31< 49909c9f8458cacb5b241106cba65aba5a6d8f4c affected
0fa81b304a7973a499f844176ca031109487dd31< 7b737e47b87589031f0d4657f6d7b0b770474925 affected
0fa81b304a7973a499f844176ca031109487dd31< 8d2b1a1ec9f559d30b724877da4ce592edc41fdc affected
8cf7db86a8984ffa3a3388a8df12bc0aa4c79bd7 affected
4.19.285< 4.19.323 affected
… +10 more rows
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2022-48938

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
CDC-NCM: avoid overflow in sanity checking
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: CDC-NCM: avoid overflow in sanity checking A broken device may give an extreme offset like 0xFFF0 and a reasonable length for a fragment. In the sanity check as formulated now, this will create an integer overflow, defeating the sanity check. Both offset and offset + len need to be checked in such a manner that no overflow can occur. And those quantities should be unsigned.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 输入验证错误漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在输入验证错误漏洞，该漏洞源于在进行完整性检查时存在整数溢出问题。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux 4ca8b8855264cf1439cdab3da7049bd1e3c2a9e6 ~ a612395c7631918e0e10ea48b9ce5ab4340f26a6 -
Linux Linux 5.7 -

II. Public POCs for CVE-2022-48938

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2022-48938

请登录查看更多情报信息。

Patches & Fixes for CVE-2022-48938 (1)

Other References for CVE-2022-48938 (4)

Same Patch Batch · Linux · 2024-08-22 · 42 CVEs total

CVE-2022-48941 8.8 HIGH ice: fix concurrent reset and removal of VFs
CVE-2022-48919 8.8 HIGH cifs: fix double free race when mount fails in cifs_get_root()
CVE-2022-48923 7.8 HIGH btrfs: prevent copying too big compressed lzo segment
CVE-2022-48925 7.8 HIGH RDMA/cma: Do not change route.addr.src_addr outside state checks
CVE-2022-48927 7.8 HIGH iio: adc: tsc2046: fix memory corruption by preventing array overflow
CVE-2022-48913 7.8 HIGH blktrace: fix use after free for struct blk_trace
CVE-2022-48912 7.8 HIGH netfilter: fix use-after-free in __nf_register_net_hook()
CVE-2022-48911 7.8 HIGH netfilter: nf_queue: fix possible use-after-free
CVE-2022-48932 7.8 HIGH net/mlx5: DR, Fix slab-out-of-bounds in mlx5_cmd_dr_create_fte
CVE-2022-48935 7.8 HIGH netfilter: nf_tables: unregister flowtable hooks on netns exit
CVE-2022-48940 7.8 HIGH bpf: Fix crash due to incorrect copy_map_value
CVE-2022-48943 7.1 HIGH KVM: x86/mmu: make apf token non-zero to fix bug
CVE-2022-48931 configfs: fix a race in configfs_{,un}register_subsystem()
CVE-2022-48930 RDMA/ib_srp: Fix a deadlock
CVE-2022-48933 netfilter: nf_tables: fix memory leak during stateful obj update
CVE-2022-48934 nfp: flower: Fix a potential leak in nfp_tunnel_add_shared_mac()
CVE-2022-48929 bpf: Fix crash due to out of bounds access into reg2btf_ids.
CVE-2022-48928 iio: adc: men_z188_adc: Fix a resource leak in an error handling path
CVE-2022-48937 io_uring: add a schedule point in io_add_buffers()
CVE-2022-48926 usb: gadget: rndis: add spinlock for rndis response list

Showing top 20 of 42 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2022-48938

No comments yet

Leave a comment