PT-2024-11871 · Linux · Linux Kernel

Ziyang Xuan · Published 2022-11-10 · Updated 2024-10-25 · CVE-2022-49008

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A potential skb leak issue has been identified in the Linux kernel, specifically in the can327 feed frame to netdev() function. This issue occurs when the netdev is down, and the function fails to free the skb, leading to a leak. The problem is exacerbated by the fact that all callers of can327 feed frame to netdev() also fail to free the allocated skb. To fix this issue, the solution involves adding a kfree skb() call in can327 feed frame to netdev() when the netdev is down.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Memory Leak

Weakness Enumeration

CWE-401

Related Identifiers

BDU:2025-14273

CVE-2022-49008

Affected Products

Linux Kernel

References · 16

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/49xxx/CVE-2022-49008.json · Exploit
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-49008 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-49008 · Vendor Advisory
• https://git.kernel.org/stable/c/797b1d9fc0e1f4351e4ad49b078c1a3cdc0d4a08 · Patch
• https://osv.dev/vulnerability/CVE-2022-49008 · Vendor Advisory
• https://git.kernel.org/stable/c/8fa452cfafed521aaf5a18c71003fe24b1ee6141 · Patch
• https://bdu.fstec.ru/vul/2025-14273 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2022-49008 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2022-49008 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-49008 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-49008 · Vendor Advisory
• https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git · Note
• https://twitter.com/CVEnew/status/1848670035096842403 · Twitter Post
• https://kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.0.12 · Note
• https://git.kernel.org/linus/8fa452cfafed521aaf5a18c71003fe24b1ee6141 · Note