SECUFOCUSNOW
Home›CVE index›CVE-2022-48956
Review reviewHigh

CVE-2022-48956

Linux Linux, linux kernel

In the Linux kernel, the following vulnerability has been resolved: ipv6: avoid use-after-free in ip6_fragment() Blamed commit claimed rcu_read_lock() was held by ip6_fragment() callers. It seems to not be always true, at least for UDP stack. syzbot reported: BUG: KASAN: use-after-free in ip6_dst_idev include/net/ip6_fib.h:245 [inline] BUG: KASAN: use-after-free in ip6_fragment+0x2724/0x2770 net/ipv6/ip6_output.c:951 Read of size 8 at addr ffff88801d403e80 by task syz-executor.3/7618 CPU: 1 PID: 7618 Comm: syz-executor.3 Not tainted 6.1.0-rc6-syzkaller-00012-g4312098baf37 #0 Hardware name:...

CVSS
7.8
EPSS
0.27%
18.2% percentile
CISA KEV
Not listed
Published
2024.10.22
PRIORITY ASSESSMENT

Review review

The CVSS severity warrants an early asset and exposure review.

Known exploitationNot established by KEV
Exploit probability0.27%
Technical severityCVSS 7.8

Vulnerability overview

In the Linux kernel, the following vulnerability has been resolved: ipv6: avoid use-after-free in ip6_fragment() Blamed commit claimed rcu_read_lock() was held by ip6_fragment() callers. It seems to not be always true, at least for UDP stack. syzbot reported: BUG: KASAN: use-after-free in ip6_dst_idev include/net/ip6_fib.h:245 [inline] BUG: KASAN: use-after-free in ip6_fragment+0x2724/0x2770 net/ipv6/ip6_output.c:951 Read of size 8 at addr ffff88801d403e80 by task syz-executor.3/7618 CPU: 1 PID: 7618 Comm: syz-executor.3 Not tainted 6.1.0-rc6-syzkaller-00012-g4312098baf37 #0 Hardware name:...

Affected product and versions

Product
Linux Linux, linux kernel
Affected versions
>= 1758fd4688eb92c796e75bdb1d256dc558ef9581 < b3d7ff8c04a83279fb7641fc4d5aa82a602df7c0, >= 1758fd4688eb92c796e75bdb1d256dc558ef9581 < 7e0dcd5f3ade221a6126278aca60c8ab4cc3bce9, >= 1758fd4688eb92c796e75bdb1d256dc558ef9581 < 6b6d3be3661bff2746cab26147bd629aa034e094, >= 1758fd4688eb92c796e75bdb1d256dc558ef9581 < 8208d7e56b1e579320b9ff3712739ad2e63e1f86, >= 1758fd4688eb92c796e75bdb1d256dc558ef9581 < 7390c70bd431cbfa6951477e2c80a301643e284b, >= 1758fd4688eb92c796e75bdb1d256dc558ef9581 < 9b1a468a455d8319041528778d0e684a4c062792, >= 1758fd4688eb92c796e75bdb1d256dc558ef9581 < 803e84867de59a1e5d126666d25eb4860cfd2ebe, >= 4.13, >= 4.13 < 4.14.302, >= 4.15 < 4.19.269, >= 4.20 < 5.4.227, >= 5.5 < 5.10.159, >= 5.11 < 5.15.83, >= 5.16 < 6.0.13, 6.1
Fixed versions
4.14.302, 4.19.269, 5.4.227, 5.10.159, 5.15.83, 6.0.13

Recommended response sequence

Confirm exposure before applying a vendor-supported change.

Full remediation guide
  1. 1
    Identify

    Confirm that Linux Linux, linux kernel and an affected version are present.

  2. 2
    Prioritize

    Combine exploitation signals with asset exposure and business criticality.

  3. 3
    Remediate

    Follow the vendor advisory or supported update path and preserve rollback options.

  4. 4
    Verify

    Recheck the version, service health, access paths, and relevant logs.

Technical data

CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE
CWE-416