Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2022-49865— ipv6: addrlabel: fix infoleak when sending struct ifaddrlblmsg to network

AI Predicted 5.3 Difficulty: Easy EPSS 0.21% · P12

Possible ATT&CK Techniques 1AI

T1005 · Data from Local System

Affected Version Matrix 18

VendorProductVersion RangeStatus
LinuxLinux2a8cc6c89039e0530a3335954253b76ed0f9339a< 568a47ff756f913e8b374c2af9d22cd2c772c744affected
2a8cc6c89039e0530a3335954253b76ed0f9339a< 0f85b7ae7c4b5d7b4bbf7ac653a733c181a8a2bfaffected
2a8cc6c89039e0530a3335954253b76ed0f9339a< 6d26d0587abccb9835382a0b53faa7b9b1cd83e3affected
2a8cc6c89039e0530a3335954253b76ed0f9339a< 58cd7fdc8c1e6c7873acc08f190069fed88d1c12affected
2a8cc6c89039e0530a3335954253b76ed0f9339a< a033b86c7f7621fde31f0364af8986f43b44914faffected
2a8cc6c89039e0530a3335954253b76ed0f9339a< 2acb2779b147decd300c117683d5a32ce61c75d6affected
2a8cc6c89039e0530a3335954253b76ed0f9339a< 49e92ba5ecd7d72ba369dde2ccff738edd028a47affected
2a8cc6c89039e0530a3335954253b76ed0f9339a< c23fb2c82267638f9d206cb96bb93e1f93ad7828affected
… +10 more rows
Get alerts for future matching vulnerabilitiesLog in to subscribe

I. Basic Information for CVE-2022-49865

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
ipv6: addrlabel: fix infoleak when sending struct ifaddrlblmsg to network
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: ipv6: addrlabel: fix infoleak when sending struct ifaddrlblmsg to network When copying a `struct ifaddrlblmsg` to the network, __ifal_reserved remained uninitialized, resulting in a 1-byte infoleak: BUG: KMSAN: kernel-network-infoleak in __netdev_start_xmit ./include/linux/netdevice.h:4841 __netdev_start_xmit ./include/linux/netdevice.h:4841 netdev_start_xmit ./include/linux/netdevice.h:4857 xmit_one net/core/dev.c:3590 dev_hard_start_xmit+0x1dc/0x800 net/core/dev.c:3606 __dev_queue_xmit+0x17e8/0x4350 net/core/dev.c:4256 dev_queue_xmit ./include/linux/netdevice.h:3009 __netlink_deliver_tap_skb net/netlink/af_netlink.c:307 __netlink_deliver_tap+0x728/0xad0 net/netlink/af_netlink.c:325 netlink_deliver_tap net/netlink/af_netlink.c:338 __netlink_sendskb net/netlink/af_netlink.c:1263 netlink_sendskb+0x1d9/0x200 net/netlink/af_netlink.c:1272 netlink_unicast+0x56d/0xf50 net/netlink/af_netlink.c:1360 nlmsg_unicast ./include/net/netlink.h:1061 rtnl_unicast+0x5a/0x80 net/core/rtnetlink.c:758 ip6addrlbl_get+0xfad/0x10f0 net/ipv6/addrlabel.c:628 rtnetlink_rcv_msg+0xb33/0x1570 net/core/rtnetlink.c:6082 ... Uninit was created at: slab_post_alloc_hook+0x118/0xb00 mm/slab.h:742 slab_alloc_node mm/slub.c:3398 __kmem_cache_alloc_node+0x4f2/0x930 mm/slub.c:3437 __do_kmalloc_node mm/slab_common.c:954 __kmalloc_node_track_caller+0x117/0x3d0 mm/slab_common.c:975 kmalloc_reserve net/core/skbuff.c:437 __alloc_skb+0x27a/0xab0 net/core/skbuff.c:509 alloc_skb ./include/linux/skbuff.h:1267 nlmsg_new ./include/net/netlink.h:964 ip6addrlbl_get+0x490/0x10f0 net/ipv6/addrlabel.c:608 rtnetlink_rcv_msg+0xb33/0x1570 net/core/rtnetlink.c:6082 netlink_rcv_skb+0x299/0x550 net/netlink/af_netlink.c:2540 rtnetlink_rcv+0x26/0x30 net/core/rtnetlink.c:6109 netlink_unicast_kernel net/netlink/af_netlink.c:1319 netlink_unicast+0x9ab/0xf50 net/netlink/af_netlink.c:1345 netlink_sendmsg+0xebc/0x10f0 net/netlink/af_netlink.c:1921 ... This patch ensures that the reserved field is always initialized.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于ipv6 addrlabel驱动中ifaddrlblmsg结构体发送时的信息泄露问题。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

VendorProductAffected VersionsCPESubscribe
LinuxLinux 2a8cc6c89039e0530a3335954253b76ed0f9339a ~ 568a47ff756f913e8b374c2af9d22cd2c772c744 -
LinuxLinux 2.6.25 -

II. Public POCs for CVE-2022-49865

#POC DescriptionSource LinkShenlong Link
AI-Generated POCPremium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2022-49865

请登录查看更多情报信息。

Patches & Fixes for CVE-2022-49865 (8)

Same Patch Batch · Linux · 2025-05-01 · 245 CVEs total

CVE-2025-377509.8 CRITICALsmb: client: fix UAF in decryption with multichannel
CVE-2025-377789.8 CRITICALksmbd: Fix dangling pointer in krb_authenticate
CVE-2022-497709.8 CRITICALceph: avoid putting the realm twice when decoding snaps fails
CVE-2022-499318.8 HIGHIB/hfi1: Correctly move list in sc_disable()
CVE-2025-377768.8 HIGHksmbd: fix use-after-free in smb_break_all_levII_oplock()
CVE-2025-377778.8 HIGHksmbd: fix use-after-free in __smb2_lease_break_noti()
CVE-2025-377908.8 HIGHnet: mctp: Set SOCK_RCU_FREE
CVE-2022-499108.8 HIGHBluetooth: L2CAP: Fix use-after-free caused by l2cap_reassemble_sdu
CVE-2022-498868.4 HIGHx86/tdx: Panic on bad configs that #VE on "private" memory access
CVE-2025-231598.4 HIGHmedia: venus: hfi: add a check to handle OOB in sfr region
CVE-2025-377498.2 HIGHnet: ppp: Add bound checking for skb data on ppp_sync_txmung
CVE-2025-377747.8 HIGHslab: ensure slab->obj_exts is clear in a newly allocated slab page
CVE-2025-377897.8 HIGHnet: openvswitch: fix nested key length validation in the set() action
CVE-2025-377797.8 HIGHlib/iov_iter: fix to increase non slab folio refcount
CVE-2022-499207.8 HIGHnetfilter: nf_tables: netlink notifier might race to release objects
CVE-2022-499197.8 HIGHnetfilter: nf_tables: release flow rule object from commit path
CVE-2025-377567.8 HIGHnet: tls: explicitly disallow disconnect
CVE-2025-377617.8 HIGHdrm/xe: Fix an out-of-bounds shift when invalidating TLB
CVE-2025-377637.8 HIGHdrm/imagination: take paired job reference
CVE-2025-231417.8 HIGHKVM: x86: Acquire SRCU in KVM_GET_MP_STATE to protect guest memory accesses

Showing top 20 of 245 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2022-49865

No comments yet

Leave a comment