5.5

CVE-2022-48911

netfilter: nf_queue: fix possible use-after-free

In the Linux kernel, the following vulnerability has been resolved:

netfilter: nf_queue: fix possible use-after-free

Eric Dumazet says:
  The sock_hold() side seems suspect, because there is no guarantee
  that sk_refcnt is not already 0.

On failure, we cannot queue the packet and need to indicate an
error.  The packet will be dropped by the caller.

v2: split skb prefetch hunk into separate change
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Linux ≫ Linux Kernel Version >= 2.6.29 < 4.9.305
Linux ≫ Linux Kernel Version >= 4.10 < 4.14.270
Linux ≫ Linux Kernel Version >= 4.15 < 4.19.233
Linux ≫ Linux Kernel Version >= 4.20 < 5.4.183
Linux ≫ Linux Kernel Version >= 5.5 < 5.10.104
Linux ≫ Linux Kernel Version >= 5.11 < 5.15.27
Linux ≫ Linux Kernel Version >= 5.16 < 5.16.13
Linux ≫ Linux Kernel Version 5.17 Update rc1
Linux ≫ Linux Kernel Version 5.17 Update rc2
Linux ≫ Linux Kernel Version 5.17 Update rc3
Linux ≫ Linux Kernel Version 5.17 Update rc4
Linux ≫ Linux Kernel Version 5.17 Update rc5
Linux ≫ Linux Kernel Version 5.17 Update rc6
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.22% 0.12
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 5.5 1.8 3.6
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
416baaa9-dc9f-4396-8d5f-8c081fb06d67 7.8 1.8 5.9
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE-416 Use After Free

The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

https://git.kernel.org/stable/c/21b27b2baa27423286e9b8d3f0b194d587083d95
Patch
https://git.kernel.org/stable/c/34dc4a6a7f261736ef7183868a5bddad31c7f9e3
Patch
https://git.kernel.org/stable/c/43c25da41e3091b31a906651a43e80a2719aa1ff
Patch
https://git.kernel.org/stable/c/4d05239203fa38ea8a6f31e228460da4cb17a71a
Patch
https://git.kernel.org/stable/c/c3873070247d9e3c7a6b0cf9bf9b45e8018427b1
Patch
https://git.kernel.org/stable/c/dcc3cb920bf7ba66ac5e9272293a9ba5f80917ee
Patch
https://git.kernel.org/stable/c/dd648bd1b33a828f62befa696b206c688da0ec43
Patch
https://git.kernel.org/stable/c/ef97921ccdc243170fcef857ba2a17cf697aece5
Patch