PT-2024-10532 · Linux+3 · Linux Kernel+3

Published 2022-01-24 · Updated 2025-01-20 · CVE-2022-48825

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel version 4.18.0-348.el8.x86 64

Description The vulnerability is related to the scsi: qedf component in the Linux kernel. It is caused by the failure to initialize the stag work for vport, resulting in a call trace when creating NPIV ports. Only 32 out of 64 ports show online. The issue can be resolved by initializing the stag work for all vports.

Recommendations For Linux kernel version 4.18.0-348.el8.x86 64, initialize the stag work for all vports to resolve the issue. As a temporary workaround, consider disabling the qedf elsct send function until a patch is available. Restrict access to the vulnerable fc lport timeout module to minimize the risk of exploitation. Avoid using the queue delayed work on function in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Weakness Enumeration

CWE-399

Related Identifiers

BDU:2025-01083

CVE-2022-48825

OPENSUSE-SU-2024_2947-1

SUSE-SU-2024:2894-1

SUSE-SU-2024:2902-1

SUSE-SU-2024:2929-1

SUSE-SU-2024:2939-1

SUSE-SU-2024:2947-1

Affected Products

Astra Linux

Linux Kernel

Red Os

Suse

References · 1237

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/48xxx/CVE-2022-48825.json · Exploit
• https://ubuntu.com/security/CVE-2022-48825 · Vendor Advisory
• https://git.kernel.org/stable/c/1f53bbf27a876f7e61262bd74c18680ac11d4c31 · Patch
• https://bdu.fstec.ru/vul/2025-01083 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2022-48825 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-48825 · Security Note
• https://git.kernel.org/stable/c/aa7352aa155e19815b41f09f114fe9f110fde4d8 · Patch
• https://osv.dev/vulnerability/SUSE-SU-2024:2929-1 · Vendor Advisory
• https://git.kernel.org/stable/c/b70a99fd13282d7885f69bf1372e28b7506a1613 · Patch
• https://cve.org/CVERecord?id=CVE-2022-48825 · Security Note
• https://git.kernel.org/stable/c/0be556512cd0dfcf5ec1a140d9f42d88221a5d4e · Patch
• https://osv.dev/vulnerability/SUSE-SU-2024:2894-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2024:2939-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-48825 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2024:2947-1 · Vendor Advisory