7.1

CVE-2022-48757

net: fix information leakage in /proc/net/ptype

In the Linux kernel, the following vulnerability has been resolved:

net: fix information leakage in /proc/net/ptype

In one net namespace, after creating a packet socket without binding
it to a device, users in other net namespaces can observe the new
`packet_type` added by this packet socket by reading `/proc/net/ptype`
file. This is minor information leakage as packet socket is
namespace aware.

Add a net pointer in `packet_type` to keep the net namespace of
of corresponding packet socket. In `ptype_seq_show`, this net pointer
must be checked when it is not NULL.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Linux ≫ Linux Kernel Version >= 2.6.26 < 4.4.302
Linux ≫ Linux Kernel Version >= 4.5 < 4.9.300
Linux ≫ Linux Kernel Version >= 4.10 < 4.14.265
Linux ≫ Linux Kernel Version >= 4.15 < 4.19.228
Linux ≫ Linux Kernel Version >= 4.20 < 5.4.176
Linux ≫ Linux Kernel Version >= 5.5 < 5.10.96
Linux ≫ Linux Kernel Version >= 5.11 < 5.15.19
Linux ≫ Linux Kernel Version >= 5.16 < 5.16.5
Linux ≫ Linux Kernel Version5.17 Updaterc1
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.01% 0.014
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 7.1 1.8 5.2
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
CWE-668 Exposure of Resource to Wrong Sphere

The product exposes a resource to the wrong control sphere, providing unintended actors with inappropriate access to the resource.