PT-2024-11824 · Linux+3 · Linux Kernel+3

Published 2022-12-08 · Updated 2025-02-11 · CVE-2022-48955

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A memory leak issue has been identified in the Linux kernel, specifically in the tbnet open() function. This issue occurs when tb ring alloc rx() fails, causing the ida allocated in tb xdomain alloc out hopid() to not be released. The vulnerability can potentially allow access to confidential information.

Recommendations To resolve the issue, apply the fix that adds tb xdomain release out hopid() to the error path to release ida when tb ring alloc rx() fails in tbnet open(). As a temporary workaround, consider restricting access to the tbnet open() function until a patch is available.

Exploit

Fix

Information Disclosure

Memory Leak

Weakness Enumeration

CWE-200

CWE-401

Related Identifiers

BDU:2025-01690

CVE-2022-48955

OPENSUSE-SU-2024_3983-1

OPENSUSE-SU-2024_3985-1

OPENSUSE-SU-2024_4131-1

SUSE-SU-2024:3983-1

SUSE-SU-2024:3985-1

SUSE-SU-2024:4082-1

SUSE-SU-2024:4131-1

SUSE-SU-2024:4364-1

Affected Products

Astra Linux

Linux Kernel

Red Os

Suse

References · 987

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/48xxx/CVE-2022-48955.json · Exploit
• https://osv.dev/vulnerability/SUSE-SU-2024:3985-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2024:4364-1 · Vendor Advisory
• https://git.kernel.org/stable/c/b9274dbe399952a8175db2e1ee148b7c9ba2b538 · Patch
• https://git.kernel.org/stable/c/ed14e5903638f6eb868e3e2b4e610985e6a6c876 · Patch
• https://security-tracker.debian.org/tracker/CVE-2022-48955 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-48955 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-48955 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-48955 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-48955 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2024:4131-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-48955 · Security Note
• https://bdu.fstec.ru/vul/2025-01690 · Security Note
• https://git.kernel.org/stable/c/ed6e955f3b7e0e622c080f4bcb5427a5e1af4c2a · Patch
• http://repo.red-soft.ru/redos/7.3c/x86_64/updates · Vendor Advisory