PT-2024-11803 · Linux+1 · Linux Kernel+1

Syzbot · Published 2022-02-13 · Updated 2024-09-25 · CVE-2022-48781

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 5.17.0-rc3-syzkaller-00316-gb81b1829e7e3

Description The vulnerability is related to the crypto: af alg module in the Linux kernel. The issue arises because the alg memory allocated field is not used, but the alg proto structure has a .memory allocated field without a corresponding .sysctl mem field. This leads to sk has account() returning true, but all sk prot mem limits() users triggering a NULL dereference. The problem occurred after the addition of SO RESERVE MEM. A general protection fault may occur due to a non-canonical address.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

NULL Pointer Dereference

Weakness Enumeration

CWE-476

Related Identifiers

BDU:2025-14259

CVE-2022-48781

Affected Products

Linux Kernel

Red Os

References · 16

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/48xxx/CVE-2022-48781.json · Exploit
• https://security-tracker.debian.org/tracker/CVE-2022-48781 · Vendor Advisory
• https://git.kernel.org/stable/c/9d06f489b9e901580159e21fdc29f73df7ed08dc · Patch
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-48781 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-48781 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2022-48781 · Security Note
• https://git.kernel.org/stable/c/25206111512de994dfc914f5b2972a22aa904ef3 · Patch
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-48781 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-48781 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-14259 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-48781 · Security Note
• https://git.kernel.org/linus/25206111512de994dfc914f5b2972a22aa904ef3 · Note
• https://lore.kernel.org/linux-cve-announce/2024071633-CVE-2022-48781-498c@gregkh · Note
• https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git · Note
• https://kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.16.11 · Note