PT-2024-10521 · Linux+3 · Linux Kernel+3

Dave Ertman · Published 2022-02-10 · Updated 2025-01-20 · CVE-2022-48807

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description The issue is related to errors in reading beyond the allocated buffer memory in the ice component of the Linux kernel. This can cause a denial of service. The problem occurs because the same handler is called for both a NETDEV BONDING INFO LAG unlink notification and a NETDEV UNREGISTER call, resulting in a KASAN stack-out-of-bounds error due to the different structure of the netdev notifier info passed depending on the event.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Out of bounds Read

Use of Uninitialized Resource

Weakness Enumeration

CWE-125

CWE-908

Related Identifiers

BDU:2025-01072

CVE-2022-48807

OPENSUSE-SU-2024_2947-1

SUSE-SU-2024:2894-1

SUSE-SU-2024:2902-1

SUSE-SU-2024:2929-1

SUSE-SU-2024:2939-1

SUSE-SU-2024:2947-1

Affected Products

Astra Linux

Linux Kernel

Red Os

Suse

References · 1232

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/48xxx/CVE-2022-48807.json · Exploit
• https://git.kernel.org/stable/c/faa9bcf700ca1a0d09f92502a6b65d3ce313fb46 · Patch
• https://git.kernel.org/stable/c/bea1898f65b9b7096cb4e73e97c83b94718f1fa1 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-48807 · Security Note
• https://osv.dev/vulnerability/CVE-2022-48807 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-01072 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2024:2929-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-48807 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2024:2894-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2024:2939-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-48807 · Vendor Advisory
• https://git.kernel.org/stable/c/f9daedc3ab8f673e3a9374b91a89fbf1174df469 · Patch
• https://osv.dev/vulnerability/SUSE-SU-2024:2947-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2022-48807 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-48807 · Vendor Advisory