PT-2022-7476 · Linux+3 · Linux Kernel+3

Published 2022-03-04 · Updated 2024-08-29 · CVE-2022-48864

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description The issue is related to the use of an uninitialized resource in the vdpa/mlx5 component of the Linux kernel. When the control vq receives a VIRTIO NET CTRL MQ VQ PAIRS SET command request from the driver, there is no validation against the number of queue pairs to configure, or even if multiqueue had been negotiated or not. This may lead to a kernel panic due to an uninitialized resource for the queues if any bogus request is sent down by an untrusted driver.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Use of Uninitialized Resource

Weakness Enumeration

CWE-908

Related Identifiers

BDU:2024-06619

CVE-2022-48864

OPENSUSE-SU-2024_2947-1

SUSE-SU-2024:2894-1

SUSE-SU-2024:2939-1

SUSE-SU-2024:2947-1

Affected Products

Astra Linux

Linux Kernel

Red Os

Suse

References · 1217

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/48xxx/CVE-2022-48864.json · Exploit
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-48864 · Vendor Advisory
• https://git.kernel.org/stable/c/9f6effca75626c7a7c7620dabcb1a254ca530230 · Patch
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-48864 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-06619 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2022-48864 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2024:2894-1 · Vendor Advisory
• https://git.kernel.org/stable/c/ed0f849fc3a63ed2ddf5e72cdb1de3bdbbb0f8eb · Patch
• https://osv.dev/vulnerability/SUSE-SU-2024:2939-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-48864 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2024:2947-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-48864 · Vendor Advisory
• https://git.kernel.org/stable/c/e7e118416465f2ba8b55007e5b789823e101421e · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-48864 · Security Note
• https://cve.org/CVERecord?id=CVE-2022-48864 · Security Note