PT-2025-18628 · Linux+2 · Linux Kernel+2

Published 2023-05-09 · Updated 2025-05-02 · CVE-2022-49911

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A vulnerability in the Linux kernel's netfilter: ipset subsystem allows the hash:net,iface type to add the same network with different interfaces to a set without limitation, leading to huge memory usage or allocation failure. The issue can be reproduced using the ipset command. The fix is to enforce the documented limit of 64 different interfaces for the same network prefix in a single set.

Recommendations To resolve the issue, apply the limit documented in the ipset(8) manpage to prevent allocating huge memory. As a temporary workaround, consider restricting the use of the hash:net,iface type in the ipset subsystem to minimize the risk of exploitation. Avoid using the hash netiface4 add function until the issue is resolved. Restrict access to the hash netiface4 resize function to prevent memory allocation failures.

Exploit

Fix

Related Identifiers

CVE-2022-49911

RHSA-2023:2458

RHSA-2023_2458

Affected Products

Astra Linux

Linux Kernel

Red Hat

References · 16

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/49xxx/CVE-2022-49911.json · Exploit
• https://git.kernel.org/stable/c/42d20d5e24575c9afa2d66d9a51e7386db9514f5 · Patch
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-49911 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2022-49911 · Security Note
• https://ubuntu.com/security/CVE-2022-49911 · Vendor Advisory
• https://git.kernel.org/stable/c/a37ef32fe5956fe9248df68f6a61997845ba047e · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-49911 · Security Note
• https://osv.dev/vulnerability/CVE-2022-49911 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2022-49911 · Vendor Advisory
• https://git.kernel.org/stable/c/510841da1fcc16f702440ab58ef0b4d82a9056b7 · Patch
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-49911 · Vendor Advisory
• https://git.kernel.org/linus/510841da1fcc16f702440ab58ef0b4d82a9056b7 · Note
• https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git · Note
• https://twitter.com/CVEnew/status/1917950806722314700 · Twitter Post
• https://lore.kernel.org/linux-cve-announce/2025050105-CVE-2022-49911-2e28@gregkh/T · Note