GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2022-48839 (GCVE-0-2022-48839)

Vulnerability from cvelistv5 – Published: 2024-07-16 12:25 – Updated: 2026-08-05 08:52
VLAI
Title
net/packet: fix slab-out-of-bounds access in packet_recvmsg()
Summary
In the Linux kernel, the following vulnerability has been resolved: net/packet: fix slab-out-of-bounds access in packet_recvmsg() syzbot found that when an AF_PACKET socket is using PACKET_COPY_THRESH and mmap operations, tpacket_rcv() is queueing skbs with garbage in skb->cb[], triggering a too big copy [1] Presumably, users of af_packet using mmap() already gets correct metadata from the mapped buffer, we can simply make sure to clear 12 bytes that might be copied to user space later. BUG: KASAN: stack-out-of-bounds in memcpy include/linux/fortify-string.h:225 [inline] BUG: KASAN: stack-out-of-bounds in packet_recvmsg+0x56c/0x1150 net/packet/af_packet.c:3489 Write of size 165 at addr ffffc9000385fb78 by task syz-executor233/3631 CPU: 0 PID: 3631 Comm: syz-executor233 Not tainted 5.17.0-rc7-syzkaller-02396-g0b3660695e80 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106 print_address_description.constprop.0.cold+0xf/0x336 mm/kasan/report.c:255 __kasan_report mm/kasan/report.c:442 [inline] kasan_report.cold+0x83/0xdf mm/kasan/report.c:459 check_region_inline mm/kasan/generic.c:183 [inline] kasan_check_range+0x13d/0x180 mm/kasan/generic.c:189 memcpy+0x39/0x60 mm/kasan/shadow.c:66 memcpy include/linux/fortify-string.h:225 [inline] packet_recvmsg+0x56c/0x1150 net/packet/af_packet.c:3489 sock_recvmsg_nosec net/socket.c:948 [inline] sock_recvmsg net/socket.c:966 [inline] sock_recvmsg net/socket.c:962 [inline] ____sys_recvmsg+0x2c4/0x600 net/socket.c:2632 ___sys_recvmsg+0x127/0x200 net/socket.c:2674 __sys_recvmsg+0xe2/0x1a0 net/socket.c:2704 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x44/0xae RIP: 0033:0x7fdfd5954c29 Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 41 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007ffcf8e71e48 EFLAGS: 00000246 ORIG_RAX: 000000000000002f RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fdfd5954c29 RDX: 0000000000000000 RSI: 0000000020000500 RDI: 0000000000000005 RBP: 0000000000000000 R08: 000000000000000d R09: 000000000000000d R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffcf8e71e60 R13: 00000000000f4240 R14: 000000000000c1ff R15: 00007ffcf8e71e54 </TASK> addr ffffc9000385fb78 is located in stack of task syz-executor233/3631 at offset 32 in frame: ____sys_recvmsg+0x0/0x600 include/linux/uio.h:246 this frame has 1 object: [32, 160) 'addr' Memory state around the buggy address: ffffc9000385fa80: 00 04 f3 f3 f3 f3 f3 00 00 00 00 00 00 00 00 00 ffffc9000385fb00: 00 00 00 00 00 00 00 00 00 00 00 f1 f1 f1 f1 00 >ffffc9000385fb80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f3 ^ ffffc9000385fc00: f3 f3 f3 00 00 00 00 00 00 00 00 00 00 00 00 f1 ffffc9000385fc80: f1 f1 f1 00 f2 f2 f2 00 f2 f2 f2 00 00 00 00 00 ==================================================================
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-09-10 16:57 UTC
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 0fb375fb9b93b7d822debc6a734052337ccfdb1f , < b9d5772d60f8e7ef34e290f72fc20e3a4883e7d0 (git)
Affected: 0fb375fb9b93b7d822debc6a734052337ccfdb1f , < b1e27cda1e3c12b705875bb7e247a97168580e33 (git)
Affected: 0fb375fb9b93b7d822debc6a734052337ccfdb1f , < a33dd1e6693f80d805155b3f69c18c2f642915da (git)
Affected: 0fb375fb9b93b7d822debc6a734052337ccfdb1f , < 268dcf1f7b3193bc446ec3d14e08a240e9561e4d (git)
Affected: 0fb375fb9b93b7d822debc6a734052337ccfdb1f , < 70b7b3c055fd4a464da8da55ff4c1f84269f9b02 (git)
Affected: 0fb375fb9b93b7d822debc6a734052337ccfdb1f , < a055f5f2841f7522b44a2b1eccb1951b4b03d51a (git)
Affected: 0fb375fb9b93b7d822debc6a734052337ccfdb1f , < ef591b35176029fdefea38e8388ffa371e18f4b2 (git)
Affected: 0fb375fb9b93b7d822debc6a734052337ccfdb1f , < c700525fcc06b05adfea78039de02628af79e07a (git)
guessed Create a notification for this product.
Linux Linux Affected: 2.6.14
Unaffected: 0 , < 2.6.14 (semver)
Unaffected: 4.9.308 , ≤ 4.9.* (semver)
Unaffected: 4.14.273 , ≤ 4.14.* (semver)
Unaffected: 4.19.236 , ≤ 4.19.* (semver)
Unaffected: 5.4.187 , ≤ 5.4.* (semver)
Unaffected: 5.10.108 , ≤ 5.10.* (semver)
Unaffected: 5.15.31 , ≤ 5.15.* (semver)
Unaffected: 5.16.17 , ≤ 5.16.* (semver)
Unaffected: 5.17 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T15:25:01.517Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/b9d5772d60f8e7ef34e290f72fc20e3a4883e7d0"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/b1e27cda1e3c12b705875bb7e247a97168580e33"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/a33dd1e6693f80d805155b3f69c18c2f642915da"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/268dcf1f7b3193bc446ec3d14e08a240e9561e4d"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/70b7b3c055fd4a464da8da55ff4c1f84269f9b02"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/a055f5f2841f7522b44a2b1eccb1951b4b03d51a"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/ef591b35176029fdefea38e8388ffa371e18f4b2"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/c700525fcc06b05adfea78039de02628af79e07a"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2022-48839",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T16:57:00.467657Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-11T17:34:10.031Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/packet/af_packet.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "b9d5772d60f8e7ef34e290f72fc20e3a4883e7d0",
              "status": "affected",
              "version": "0fb375fb9b93b7d822debc6a734052337ccfdb1f",
              "versionType": "git"
            },
            {
              "lessThan": "b1e27cda1e3c12b705875bb7e247a97168580e33",
              "status": "affected",
              "version": "0fb375fb9b93b7d822debc6a734052337ccfdb1f",
              "versionType": "git"
            },
            {
              "lessThan": "a33dd1e6693f80d805155b3f69c18c2f642915da",
              "status": "affected",
              "version": "0fb375fb9b93b7d822debc6a734052337ccfdb1f",
              "versionType": "git"
            },
            {
              "lessThan": "268dcf1f7b3193bc446ec3d14e08a240e9561e4d",
              "status": "affected",
              "version": "0fb375fb9b93b7d822debc6a734052337ccfdb1f",
              "versionType": "git"
            },
            {
              "lessThan": "70b7b3c055fd4a464da8da55ff4c1f84269f9b02",
              "status": "affected",
              "version": "0fb375fb9b93b7d822debc6a734052337ccfdb1f",
              "versionType": "git"
            },
            {
              "lessThan": "a055f5f2841f7522b44a2b1eccb1951b4b03d51a",
              "status": "affected",
              "version": "0fb375fb9b93b7d822debc6a734052337ccfdb1f",
              "versionType": "git"
            },
            {
              "lessThan": "ef591b35176029fdefea38e8388ffa371e18f4b2",
              "status": "affected",
              "version": "0fb375fb9b93b7d822debc6a734052337ccfdb1f",
              "versionType": "git"
            },
            {
              "lessThan": "c700525fcc06b05adfea78039de02628af79e07a",
              "status": "affected",
              "version": "0fb375fb9b93b7d822debc6a734052337ccfdb1f",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/packet/af_packet.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.14"
            },
            {
              "lessThan": "2.6.14",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.9.*",
              "status": "unaffected",
              "version": "4.9.308",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.14.*",
              "status": "unaffected",
              "version": "4.14.273",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.19.*",
              "status": "unaffected",
              "version": "4.19.236",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.187",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.108",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.31",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.16.*",
              "status": "unaffected",
              "version": "5.16.17",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "5.17",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.9.308",
                  "versionStartIncluding": "2.6.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.14.273",
                  "versionStartIncluding": "2.6.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.19.236",
                  "versionStartIncluding": "2.6.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.187",
                  "versionStartIncluding": "2.6.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.108",
                  "versionStartIncluding": "2.6.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.31",
                  "versionStartIncluding": "2.6.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.16.17",
                  "versionStartIncluding": "2.6.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.17",
                  "versionStartIncluding": "2.6.14",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/packet: fix slab-out-of-bounds access in packet_recvmsg()\n\nsyzbot found that when an AF_PACKET socket is using PACKET_COPY_THRESH\nand mmap operations, tpacket_rcv() is queueing skbs with\ngarbage in skb-\u003ecb[], triggering a too big copy [1]\n\nPresumably, users of af_packet using mmap() already gets correct\nmetadata from the mapped buffer, we can simply make sure\nto clear 12 bytes that might be copied to user space later.\n\nBUG: KASAN: stack-out-of-bounds in memcpy include/linux/fortify-string.h:225 [inline]\nBUG: KASAN: stack-out-of-bounds in packet_recvmsg+0x56c/0x1150 net/packet/af_packet.c:3489\nWrite of size 165 at addr ffffc9000385fb78 by task syz-executor233/3631\n\nCPU: 0 PID: 3631 Comm: syz-executor233 Not tainted 5.17.0-rc7-syzkaller-02396-g0b3660695e80 #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011\nCall Trace:\n \u003cTASK\u003e\n __dump_stack lib/dump_stack.c:88 [inline]\n dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106\n print_address_description.constprop.0.cold+0xf/0x336 mm/kasan/report.c:255\n __kasan_report mm/kasan/report.c:442 [inline]\n kasan_report.cold+0x83/0xdf mm/kasan/report.c:459\n check_region_inline mm/kasan/generic.c:183 [inline]\n kasan_check_range+0x13d/0x180 mm/kasan/generic.c:189\n memcpy+0x39/0x60 mm/kasan/shadow.c:66\n memcpy include/linux/fortify-string.h:225 [inline]\n packet_recvmsg+0x56c/0x1150 net/packet/af_packet.c:3489\n sock_recvmsg_nosec net/socket.c:948 [inline]\n sock_recvmsg net/socket.c:966 [inline]\n sock_recvmsg net/socket.c:962 [inline]\n ____sys_recvmsg+0x2c4/0x600 net/socket.c:2632\n ___sys_recvmsg+0x127/0x200 net/socket.c:2674\n __sys_recvmsg+0xe2/0x1a0 net/socket.c:2704\n do_syscall_x64 arch/x86/entry/common.c:50 [inline]\n do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80\n entry_SYSCALL_64_after_hwframe+0x44/0xae\nRIP: 0033:0x7fdfd5954c29\nCode: 28 00 00 00 75 05 48 83 c4 28 c3 e8 41 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 \u003c48\u003e 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48\nRSP: 002b:00007ffcf8e71e48 EFLAGS: 00000246 ORIG_RAX: 000000000000002f\nRAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fdfd5954c29\nRDX: 0000000000000000 RSI: 0000000020000500 RDI: 0000000000000005\nRBP: 0000000000000000 R08: 000000000000000d R09: 000000000000000d\nR10: 0000000000000000 R11: 0000000000000246 R12: 00007ffcf8e71e60\nR13: 00000000000f4240 R14: 000000000000c1ff R15: 00007ffcf8e71e54\n \u003c/TASK\u003e\n\naddr ffffc9000385fb78 is located in stack of task syz-executor233/3631 at offset 32 in frame:\n ____sys_recvmsg+0x0/0x600 include/linux/uio.h:246\n\nthis frame has 1 object:\n [32, 160) \u0027addr\u0027\n\nMemory state around the buggy address:\n ffffc9000385fa80: 00 04 f3 f3 f3 f3 f3 00 00 00 00 00 00 00 00 00\n ffffc9000385fb00: 00 00 00 00 00 00 00 00 00 00 00 f1 f1 f1 f1 00\n\u003effffc9000385fb80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f3\n                                                                ^\n ffffc9000385fc00: f3 f3 f3 00 00 00 00 00 00 00 00 00 00 00 00 f1\n ffffc9000385fc80: f1 f1 f1 00 f2 f2 f2 00 f2 f2 f2 00 00 00 00 00\n=================================================================="
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - Exploitation requires a local AF_PACKET socket configured with PACKET_RX_RING (mmap) and PACKET_COPY_THRESH, then a local recvmsg/recvfrom; a remote packet alone cannot reach packet_recvmsg without that local setup.\nAC:L - The attacker fully controls socket options, ring geometry, oversized-packet delivery (e.g. in their own netns), and the recvmsg that uses the bogus sll_halen; no race or victim-controlled precondition is required.\nPR:L - packet_create() only checks ns_capable(net-\u003euser_ns, CAP_NET_RAW), which an unprivileged user obtains via user+network namespaces (unshare -Urn), matching established AF_PACKET scoring.\nUI:N - The attacker performs socket setup, packet injection, and recvmsg entirely themselves; no separate victim action is required.\nS:U - Impact is kernel stack/heap memory corruption and local privilege escalation within the same host kernel authority, not a VM/IOMMU/sandbox boundary escape.\nC:H - Oversized memcpy from PACKET_SKB_CB (skb-\u003ecb) reads past the intended sockaddr into other sk_buff fields/adjacent memory and copies that data toward userspace via msg_name, yielding a high-impact kernel disclosure primitive.\nI:H - The same path performs a kernel stack out-of-bounds write past sockaddr_storage in ____sys_recvmsg (observed write of size 165), which is an exploitable corruption primitive for control-flow hijacking.\nA:H - The stack smash and subsequent move_addr_to_user BUG_ON(klen \u003e sizeof(sockaddr_storage)) cause kernel oops/panic, so availability impact is complete host crash."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T08:52:36.447Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/b9d5772d60f8e7ef34e290f72fc20e3a4883e7d0"
        },
        {
          "url": "https://git.kernel.org/stable/c/b1e27cda1e3c12b705875bb7e247a97168580e33"
        },
        {
          "url": "https://git.kernel.org/stable/c/a33dd1e6693f80d805155b3f69c18c2f642915da"
        },
        {
          "url": "https://git.kernel.org/stable/c/268dcf1f7b3193bc446ec3d14e08a240e9561e4d"
        },
        {
          "url": "https://git.kernel.org/stable/c/70b7b3c055fd4a464da8da55ff4c1f84269f9b02"
        },
        {
          "url": "https://git.kernel.org/stable/c/a055f5f2841f7522b44a2b1eccb1951b4b03d51a"
        },
        {
          "url": "https://git.kernel.org/stable/c/ef591b35176029fdefea38e8388ffa371e18f4b2"
        },
        {
          "url": "https://git.kernel.org/stable/c/c700525fcc06b05adfea78039de02628af79e07a"
        }
      ],
      "title": "net/packet: fix slab-out-of-bounds access in packet_recvmsg()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2022-48839",
    "datePublished": "2024-07-16T12:25:10.521Z",
    "dateReserved": "2024-07-16T11:38:08.909Z",
    "dateUpdated": "2026-08-05T08:52:36.447Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2022-48839",
      "date": "2026-09-16",
      "epss": "0.00269",
      "percentile": "0.19193"
    },
    "fkie_nvd": {
      "configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"2.6.14\", \"versionEndExcluding\": \"4.9.308\", \"matchCriteriaId\": \"661D636E-06A1-4E3D-A282-F625B52C2A61\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"4.10\", \"versionEndExcluding\": \"4.14.273\", \"matchCriteriaId\": \"A1E9CE4F-B0EA-4F88-9562-4F113E598085\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"4.15\", \"versionEndExcluding\": \"4.19.236\", \"matchCriteriaId\": \"09979837-E01F-4E28-B943-9F680CA3D278\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"4.20\", \"versionEndExcluding\": \"5.4.187\", \"matchCriteriaId\": \"D9FFB805-4ED2-4FAE-9EF4-8AB4BC9D8F5C\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"5.5\", \"versionEndExcluding\": \"5.10.108\", \"matchCriteriaId\": \"24925527-AC4A-4594-8D6C-3B34D31862C5\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"5.11\", \"versionEndExcluding\": \"5.15.31\", \"matchCriteriaId\": \"F25C317E-A673-47D1-844E-171C9BFDF352\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"5.16\", \"versionEndExcluding\": \"5.16.17\", \"matchCriteriaId\": \"DC9A634D-C617-4F8C-ADEF-AF94CE69D687\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnet/packet: fix slab-out-of-bounds access in packet_recvmsg()\\n\\nsyzbot found that when an AF_PACKET socket is using PACKET_COPY_THRESH\\nand mmap operations, tpacket_rcv() is queueing skbs with\\ngarbage in skb-\u003ecb[], triggering a too big copy [1]\\n\\nPresumably, users of af_packet using mmap() already gets correct\\nmetadata from the mapped buffer, we can simply make sure\\nto clear 12 bytes that might be copied to user space later.\\n\\nBUG: KASAN: stack-out-of-bounds in memcpy include/linux/fortify-string.h:225 [inline]\\nBUG: KASAN: stack-out-of-bounds in packet_recvmsg+0x56c/0x1150 net/packet/af_packet.c:3489\\nWrite of size 165 at addr ffffc9000385fb78 by task syz-executor233/3631\\n\\nCPU: 0 PID: 3631 Comm: syz-executor233 Not tainted 5.17.0-rc7-syzkaller-02396-g0b3660695e80 #0\\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011\\nCall Trace:\\n \u003cTASK\u003e\\n __dump_stack lib/dump_stack.c:88 [inline]\\n dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106\\n print_address_description.constprop.0.cold+0xf/0x336 mm/kasan/report.c:255\\n __kasan_report mm/kasan/report.c:442 [inline]\\n kasan_report.cold+0x83/0xdf mm/kasan/report.c:459\\n check_region_inline mm/kasan/generic.c:183 [inline]\\n kasan_check_range+0x13d/0x180 mm/kasan/generic.c:189\\n memcpy+0x39/0x60 mm/kasan/shadow.c:66\\n memcpy include/linux/fortify-string.h:225 [inline]\\n packet_recvmsg+0x56c/0x1150 net/packet/af_packet.c:3489\\n sock_recvmsg_nosec net/socket.c:948 [inline]\\n sock_recvmsg net/socket.c:966 [inline]\\n sock_recvmsg net/socket.c:962 [inline]\\n ____sys_recvmsg+0x2c4/0x600 net/socket.c:2632\\n ___sys_recvmsg+0x127/0x200 net/socket.c:2674\\n __sys_recvmsg+0xe2/0x1a0 net/socket.c:2704\\n do_syscall_x64 arch/x86/entry/common.c:50 [inline]\\n do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80\\n entry_SYSCALL_64_after_hwframe+0x44/0xae\\nRIP: 0033:0x7fdfd5954c29\\nCode: 28 00 00 00 75 05 48 83 c4 28 c3 e8 41 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 \u003c48\u003e 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48\\nRSP: 002b:00007ffcf8e71e48 EFLAGS: 00000246 ORIG_RAX: 000000000000002f\\nRAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fdfd5954c29\\nRDX: 0000000000000000 RSI: 0000000020000500 RDI: 0000000000000005\\nRBP: 0000000000000000 R08: 000000000000000d R09: 000000000000000d\\nR10: 0000000000000000 R11: 0000000000000246 R12: 00007ffcf8e71e60\\nR13: 00000000000f4240 R14: 000000000000c1ff R15: 00007ffcf8e71e54\\n \u003c/TASK\u003e\\n\\naddr ffffc9000385fb78 is located in stack of task syz-executor233/3631 at offset 32 in frame:\\n ____sys_recvmsg+0x0/0x600 include/linux/uio.h:246\\n\\nthis frame has 1 object:\\n [32, 160) \u0027addr\u0027\\n\\nMemory state around the buggy address:\\n ffffc9000385fa80: 00 04 f3 f3 f3 f3 f3 00 00 00 00 00 00 00 00 00\\n ffffc9000385fb00: 00 00 00 00 00 00 00 00 00 00 00 f1 f1 f1 f1 00\\n\u003effffc9000385fb80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f3\\n                                                                ^\\n ffffc9000385fc00: f3 f3 f3 00 00 00 00 00 00 00 00 00 00 00 00 f1\\n ffffc9000385fc80: f1 f1 f1 00 f2 f2 f2 00 f2 f2 f2 00 00 00 00 00\\n==================================================================\"}, {\"lang\": \"es\", \"value\": \"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: net/packet: corrige el acceso slab-out-of-bounds en paquete_recvmsg() syzbot descubri\\u00f3 que cuando un socket AF_PACKET utiliza operaciones PACKET_COPY_THRESH y mmap, tpacket_rcv() est\\u00e1 poniendo en cola skbs con basura en skb-\u0026gt;cb[], lo que desencadena una copia demasiado grande [1] Presumiblemente, los usuarios de af_packet que usan mmap() ya obtienen los metadatos correctos del b\\u00fafer asignado, simplemente podemos asegurarnos de borrar 12 bytes que podr\\u00edan copiarse al usuario espacio m\\u00e1s tarde. ERROR: KASAN: pila fuera de los l\\u00edmites en memcpy include/linux/fortify-string.h:225 [en l\\u00ednea] ERROR: KASAN: pila fuera de los l\\u00edmites en paquete_recvmsg+0x56c/0x1150 net/packet/af_packet. c:3489 Escritura de tama\\u00f1o 165 en la direcci\\u00f3n ffffc9000385fb78 por tarea syz-executor233/3631 CPU: 0 PID: 3631 Comm: syz-executor233 Not tainted 5.17.0-rc7-syzkaller-02396-g0b3660695e80 #0 Nombre de hardware: Google Google Compute Engine /Google Compute Engine, BIOS Google 01/01/2011 Seguimiento de llamadas:  __dump_stack lib/dump_stack.c:88 [en l\\u00ednea] dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106 print_address_description.constprop.0.cold+0xf /0x336 mm/kasan/report.c:255 __kasan_report mm/kasan/report.c:442 [en l\\u00ednea] kasan_report.cold+0x83/0xdf mm/kasan/report.c:459 check_region_inline mm/kasan/generic.c:183 [en l\\u00ednea] kasan_check_range+0x13d/0x180 mm/kasan/generic.c:189 memcpy+0x39/0x60 mm/kasan/shadow.c:66 memcpy include/linux/fortify-string.h:225 [en l\\u00ednea] paquete_recvmsg+0x56c/ 0x1150 net/packet/af_packet.c:3489 sock_recvmsg_nosec net/socket.c:948 [en l\\u00ednea] sock_recvmsg net/socket.c:966 [en l\\u00ednea] sock_recvmsg net/socket.c:962 [en l\\u00ednea] ____sys_recvmsg+0x2c4/0x600 net/ socket.c:2632 ___sys_recvmsg+0x127/0x200 net/socket.c:2674 __sys_recvmsg+0xe2/0x1a0 net/socket.c:2704 do_syscall_x64 arch/x86/entry/common.c:50 [en l\\u00ednea] arco xb0 /x86/entry/common.c:80 Entry_SYSCALL_64_after_hwframe+0x44/0xae RIP: 0033:0x7fdfd5954c29 C\\u00f3digo: 28 00 00 00 75 05 48 83 c4 28 c3 e8 41 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 \u0026lt;48\u0026gt; 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007ffcf8e71e48 EFLAGS: 0000246 ORIG_RAX: 000000000000002f RAX : ffffffffffffffda RBX: 0000000000000003 RCX: 00007fdfd5954c29 RDX: 0000000000000000 RSI: 0000000020000500 RDI: 000000000000005 RBP: 0000000 000000000 R08: 000000000000000d R09: 000000000000000d R10: 0000000000000000 R11: 00000000000000246 R12: 00007ffcf8e71e60 R13: 0000f4240 R14: 000000000000c1ff R15: 00007ffcf8e71e54  direcci\\u00f3n ffffc9000385fb78 est\\u00e1 ubicado en la pila de la tarea syz-executor233/3631 en el desplazamiento 32 en el marco: ____sys_recvmsg+0x0/0x600 include/linux/uio.h:246 este marco tiene 1 objeto: [32, 160) \u0027addr\u0027 Estado de memoria alrededor del buggy direcci\\u00f3n: ffffc9000385fa80: 00 04 f3 f3 f3 f3 f3 00 00 00 00 00 00 00 00 00 ffffc9000385fb00: 00 00 00 00 00 00 00 00 00 00 00 f1 f1 f1 f1 00 c9000385fb80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f3 ^ ffffc9000385fc00: f3 f3 f3 00 00 00 00 00 00 00 00 00 00 00 00 f1 ffffc9000385fc80: f1 f1 f1 00 f2 f2 f2 00 f2 f2 f2 0 0 00 00 00 00 ====== ==================================================== ==========\"}]",
      "id": "CVE-2022-48839",
      "lastModified": "2024-11-21T07:34:11.183",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\", \"baseScore\": 5.5, \"baseSeverity\": \"MEDIUM\", \"attackVector\": \"LOCAL\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"LOW\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"NONE\", \"integrityImpact\": \"NONE\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 1.8, \"impactScore\": 3.6}]}",
      "published": "2024-07-16T13:15:11.353",
      "references": "[{\"url\": \"https://git.kernel.org/stable/c/268dcf1f7b3193bc446ec3d14e08a240e9561e4d\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Mailing List\", \"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/70b7b3c055fd4a464da8da55ff4c1f84269f9b02\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Mailing List\", \"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/a055f5f2841f7522b44a2b1eccb1951b4b03d51a\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Mailing List\", \"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/a33dd1e6693f80d805155b3f69c18c2f642915da\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Mailing List\", \"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/b1e27cda1e3c12b705875bb7e247a97168580e33\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Mailing List\", \"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/b9d5772d60f8e7ef34e290f72fc20e3a4883e7d0\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Mailing List\", \"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/c700525fcc06b05adfea78039de02628af79e07a\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Mailing List\", \"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/ef591b35176029fdefea38e8388ffa371e18f4b2\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Mailing List\", \"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/268dcf1f7b3193bc446ec3d14e08a240e9561e4d\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Mailing List\", \"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/70b7b3c055fd4a464da8da55ff4c1f84269f9b02\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Mailing List\", \"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/a055f5f2841f7522b44a2b1eccb1951b4b03d51a\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Mailing List\", \"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/a33dd1e6693f80d805155b3f69c18c2f642915da\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Mailing List\", \"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/b1e27cda1e3c12b705875bb7e247a97168580e33\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Mailing List\", \"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/b9d5772d60f8e7ef34e290f72fc20e3a4883e7d0\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Mailing List\", \"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/c700525fcc06b05adfea78039de02628af79e07a\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Mailing List\", \"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/ef591b35176029fdefea38e8388ffa371e18f4b2\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Mailing List\", \"Patch\"]}]",
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Modified",
      "weaknesses": "[{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-125\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2022-48839\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-07-16T13:15:11.353\",\"lastModified\":\"2026-08-04T10:17:23.723\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnet/packet: fix slab-out-of-bounds access in packet_recvmsg()\\n\\nsyzbot found that when an AF_PACKET socket is using PACKET_COPY_THRESH\\nand mmap operations, tpacket_rcv() is queueing skbs with\\ngarbage in skb-\u003ecb[], triggering a too big copy [1]\\n\\nPresumably, users of af_packet using mmap() already gets correct\\nmetadata from the mapped buffer, we can simply make sure\\nto clear 12 bytes that might be copied to user space later.\\n\\nBUG: KASAN: stack-out-of-bounds in memcpy include/linux/fortify-string.h:225 [inline]\\nBUG: KASAN: stack-out-of-bounds in packet_recvmsg+0x56c/0x1150 net/packet/af_packet.c:3489\\nWrite of size 165 at addr ffffc9000385fb78 by task syz-executor233/3631\\n\\nCPU: 0 PID: 3631 Comm: syz-executor233 Not tainted 5.17.0-rc7-syzkaller-02396-g0b3660695e80 #0\\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011\\nCall Trace:\\n \u003cTASK\u003e\\n __dump_stack lib/dump_stack.c:88 [inline]\\n dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106\\n print_address_description.constprop.0.cold+0xf/0x336 mm/kasan/report.c:255\\n __kasan_report mm/kasan/report.c:442 [inline]\\n kasan_report.cold+0x83/0xdf mm/kasan/report.c:459\\n check_region_inline mm/kasan/generic.c:183 [inline]\\n kasan_check_range+0x13d/0x180 mm/kasan/generic.c:189\\n memcpy+0x39/0x60 mm/kasan/shadow.c:66\\n memcpy include/linux/fortify-string.h:225 [inline]\\n packet_recvmsg+0x56c/0x1150 net/packet/af_packet.c:3489\\n sock_recvmsg_nosec net/socket.c:948 [inline]\\n sock_recvmsg net/socket.c:966 [inline]\\n sock_recvmsg net/socket.c:962 [inline]\\n ____sys_recvmsg+0x2c4/0x600 net/socket.c:2632\\n ___sys_recvmsg+0x127/0x200 net/socket.c:2674\\n __sys_recvmsg+0xe2/0x1a0 net/socket.c:2704\\n do_syscall_x64 arch/x86/entry/common.c:50 [inline]\\n do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80\\n entry_SYSCALL_64_after_hwframe+0x44/0xae\\nRIP: 0033:0x7fdfd5954c29\\nCode: 28 00 00 00 75 05 48 83 c4 28 c3 e8 41 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 \u003c48\u003e 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48\\nRSP: 002b:00007ffcf8e71e48 EFLAGS: 00000246 ORIG_RAX: 000000000000002f\\nRAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fdfd5954c29\\nRDX: 0000000000000000 RSI: 0000000020000500 RDI: 0000000000000005\\nRBP: 0000000000000000 R08: 000000000000000d R09: 000000000000000d\\nR10: 0000000000000000 R11: 0000000000000246 R12: 00007ffcf8e71e60\\nR13: 00000000000f4240 R14: 000000000000c1ff R15: 00007ffcf8e71e54\\n \u003c/TASK\u003e\\n\\naddr ffffc9000385fb78 is located in stack of task syz-executor233/3631 at offset 32 in frame:\\n ____sys_recvmsg+0x0/0x600 include/linux/uio.h:246\\n\\nthis frame has 1 object:\\n [32, 160) \u0027addr\u0027\\n\\nMemory state around the buggy address:\\n ffffc9000385fa80: 00 04 f3 f3 f3 f3 f3 00 00 00 00 00 00 00 00 00\\n ffffc9000385fb00: 00 00 00 00 00 00 00 00 00 00 00 f1 f1 f1 f1 00\\n\u003effffc9000385fb80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f3\\n                                                                ^\\n ffffc9000385fc00: f3 f3 f3 00 00 00 00 00 00 00 00 00 00 00 00 f1\\n ffffc9000385fc80: f1 f1 f1 00 f2 f2 f2 00 f2 f2 f2 00 00 00 00 00\\n==================================================================\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: net/packet: corrige el acceso slab-out-of-bounds en paquete_recvmsg() syzbot descubri\u00f3 que cuando un socket AF_PACKET utiliza operaciones PACKET_COPY_THRESH y mmap, tpacket_rcv() est\u00e1 poniendo en cola skbs con basura en skb-\u0026gt;cb[], lo que desencadena una copia demasiado grande [1] Presumiblemente, los usuarios de af_packet que usan mmap() ya obtienen los metadatos correctos del b\u00fafer asignado, simplemente podemos asegurarnos de borrar 12 bytes que podr\u00edan copiarse al usuario espacio m\u00e1s tarde. ERROR: KASAN: pila fuera de los l\u00edmites en memcpy include/linux/fortify-string.h:225 [en l\u00ednea] ERROR: KASAN: pila fuera de los l\u00edmites en paquete_recvmsg+0x56c/0x1150 net/packet/af_packet. c:3489 Escritura de tama\u00f1o 165 en la direcci\u00f3n ffffc9000385fb78 por tarea syz-executor233/3631 CPU: 0 PID: 3631 Comm: syz-executor233 Not tainted 5.17.0-rc7-syzkaller-02396-g0b3660695e80 #0 Nombre de hardware: Google Google Compute Engine /Google Compute Engine, BIOS Google 01/01/2011 Seguimiento de llamadas:  __dump_stack lib/dump_stack.c:88 [en l\u00ednea] dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106 print_address_description.constprop.0.cold+0xf /0x336 mm/kasan/report.c:255 __kasan_report mm/kasan/report.c:442 [en l\u00ednea] kasan_report.cold+0x83/0xdf mm/kasan/report.c:459 check_region_inline mm/kasan/generic.c:183 [en l\u00ednea] kasan_check_range+0x13d/0x180 mm/kasan/generic.c:189 memcpy+0x39/0x60 mm/kasan/shadow.c:66 memcpy include/linux/fortify-string.h:225 [en l\u00ednea] paquete_recvmsg+0x56c/ 0x1150 net/packet/af_packet.c:3489 sock_recvmsg_nosec net/socket.c:948 [en l\u00ednea] sock_recvmsg net/socket.c:966 [en l\u00ednea] sock_recvmsg net/socket.c:962 [en l\u00ednea] ____sys_recvmsg+0x2c4/0x600 net/ socket.c:2632 ___sys_recvmsg+0x127/0x200 net/socket.c:2674 __sys_recvmsg+0xe2/0x1a0 net/socket.c:2704 do_syscall_x64 arch/x86/entry/common.c:50 [en l\u00ednea] arco xb0 /x86/entry/common.c:80 Entry_SYSCALL_64_after_hwframe+0x44/0xae RIP: 0033:0x7fdfd5954c29 C\u00f3digo: 28 00 00 00 75 05 48 83 c4 28 c3 e8 41 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 \u0026lt;48\u0026gt; 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007ffcf8e71e48 EFLAGS: 0000246 ORIG_RAX: 000000000000002f RAX : ffffffffffffffda RBX: 0000000000000003 RCX: 00007fdfd5954c29 RDX: 0000000000000000 RSI: 0000000020000500 RDI: 000000000000005 RBP: 0000000 000000000 R08: 000000000000000d R09: 000000000000000d R10: 0000000000000000 R11: 00000000000000246 R12: 00007ffcf8e71e60 R13: 0000f4240 R14: 000000000000c1ff R15: 00007ffcf8e71e54  direcci\u00f3n ffffc9000385fb78 est\u00e1 ubicado en la pila de la tarea syz-executor233/3631 en el desplazamiento 32 en el marco: ____sys_recvmsg+0x0/0x600 include/linux/uio.h:246 este marco tiene 1 objeto: [32, 160) \u0027addr\u0027 Estado de memoria alrededor del buggy direcci\u00f3n: ffffc9000385fa80: 00 04 f3 f3 f3 f3 f3 00 00 00 00 00 00 00 00 00 ffffc9000385fb00: 00 00 00 00 00 00 00 00 00 00 00 f1 f1 f1 f1 00 c9000385fb80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f3 ^ ffffc9000385fc00: f3 f3 f3 00 00 00 00 00 00 00 00 00 00 00 00 f1 ffffc9000385fc80: f1 f1 f1 00 f2 f2 f2 00 f2 f2 f2 0 0 00 00 00 00 ====== ==================================================== ==========\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"net/packet/af_packet.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"0fb375fb9b93b7d822debc6a734052337ccfdb1f\",\"lessThan\":\"b9d5772d60f8e7ef34e290f72fc20e3a4883e7d0\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"0fb375fb9b93b7d822debc6a734052337ccfdb1f\",\"lessThan\":\"b1e27cda1e3c12b705875bb7e247a97168580e33\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"0fb375fb9b93b7d822debc6a734052337ccfdb1f\",\"lessThan\":\"a33dd1e6693f80d805155b3f69c18c2f642915da\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"0fb375fb9b93b7d822debc6a734052337ccfdb1f\",\"lessThan\":\"268dcf1f7b3193bc446ec3d14e08a240e9561e4d\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"0fb375fb9b93b7d822debc6a734052337ccfdb1f\",\"lessThan\":\"70b7b3c055fd4a464da8da55ff4c1f84269f9b02\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"0fb375fb9b93b7d822debc6a734052337ccfdb1f\",\"lessThan\":\"a055f5f2841f7522b44a2b1eccb1951b4b03d51a\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"0fb375fb9b93b7d822debc6a734052337ccfdb1f\",\"lessThan\":\"ef591b35176029fdefea38e8388ffa371e18f4b2\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"0fb375fb9b93b7d822debc6a734052337ccfdb1f\",\"lessThan\":\"c700525fcc06b05adfea78039de02628af79e07a\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"net/packet/af_packet.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"2.6.14\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"2.6.14\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"4.9.308\",\"lessThanOrEqual\":\"4.9.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"4.14.273\",\"lessThanOrEqual\":\"4.14.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"4.19.236\",\"lessThanOrEqual\":\"4.19.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.4.187\",\"lessThanOrEqual\":\"5.4.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.108\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.31\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.16.17\",\"lessThanOrEqual\":\"5.16.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.17\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2024-09-10T16:57:00.467657Z\",\"id\":\"CVE-2022-48839\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-125\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"2.6.14\",\"versionEndExcluding\":\"4.9.308\",\"matchCriteriaId\":\"661D636E-06A1-4E3D-A282-F625B52C2A61\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.10\",\"versionEndExcluding\":\"4.14.273\",\"matchCriteriaId\":\"A1E9CE4F-B0EA-4F88-9562-4F113E598085\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.15\",\"versionEndExcluding\":\"4.19.236\",\"matchCriteriaId\":\"09979837-E01F-4E28-B943-9F680CA3D278\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.20\",\"versionEndExcluding\":\"5.4.187\",\"matchCriteriaId\":\"D9FFB805-4ED2-4FAE-9EF4-8AB4BC9D8F5C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.5\",\"versionEndExcluding\":\"5.10.108\",\"matchCriteriaId\":\"24925527-AC4A-4594-8D6C-3B34D31862C5\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.11\",\"versionEndExcluding\":\"5.15.31\",\"matchCriteriaId\":\"F25C317E-A673-47D1-844E-171C9BFDF352\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.16\",\"versionEndExcluding\":\"5.16.17\",\"matchCriteriaId\":\"DC9A634D-C617-4F8C-ADEF-AF94CE69D687\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/268dcf1f7b3193bc446ec3d14e08a240e9561e4d\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Mailing List\",\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/70b7b3c055fd4a464da8da55ff4c1f84269f9b02\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Mailing List\",\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/a055f5f2841f7522b44a2b1eccb1951b4b03d51a\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Mailing List\",\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/a33dd1e6693f80d805155b3f69c18c2f642915da\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Mailing List\",\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/b1e27cda1e3c12b705875bb7e247a97168580e33\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Mailing List\",\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/b9d5772d60f8e7ef34e290f72fc20e3a4883e7d0\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Mailing List\",\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/c700525fcc06b05adfea78039de02628af79e07a\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Mailing List\",\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/ef591b35176029fdefea38e8388ffa371e18f4b2\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Mailing List\",\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/268dcf1f7b3193bc446ec3d14e08a240e9561e4d\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\",\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/70b7b3c055fd4a464da8da55ff4c1f84269f9b02\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\",\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/a055f5f2841f7522b44a2b1eccb1951b4b03d51a\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\",\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/a33dd1e6693f80d805155b3f69c18c2f642915da\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\",\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/b1e27cda1e3c12b705875bb7e247a97168580e33\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\",\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/b9d5772d60f8e7ef34e290f72fc20e3a4883e7d0\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\",\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/c700525fcc06b05adfea78039de02628af79e07a\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\",\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/ef591b35176029fdefea38e8388ffa371e18f4b2\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\",\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-04T19:48:09+00:00",
      "cve": "CVE-2022-48839",
      "id": "CVE-2022-48839",
      "initial_release_date": "2022-01-01T00:00:00+00:00",
      "product_status:known_affected": "198",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: net/packet: fix slab-out-of-bounds access in packet_recvmsg()",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2022/cve-2022-48839.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-11T16:56:16Z",
      "cve": "CVE-2022-48839",
      "id": "CVE-2022-48839",
      "initial_release_date": "2024-07-18T03:05:48Z",
      "product_status:known_not_affected": "187",
      "product_status:recommended": "568",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2022-48839",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2022-48839.json",
      "version": "55"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://git.kernel.org/stable/c/b9d5772d60f8e7ef34e290f72fc20e3a4883e7d0\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/b1e27cda1e3c12b705875bb7e247a97168580e33\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/a33dd1e6693f80d805155b3f69c18c2f642915da\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/268dcf1f7b3193bc446ec3d14e08a240e9561e4d\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/70b7b3c055fd4a464da8da55ff4c1f84269f9b02\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/a055f5f2841f7522b44a2b1eccb1951b4b03d51a\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/ef591b35176029fdefea38e8388ffa371e18f4b2\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/c700525fcc06b05adfea78039de02628af79e07a\", \"tags\": [\"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-03T15:25:01.517Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2022-48839\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-09-10T16:57:00.467657Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-09-11T12:42:21.083Z\"}}], \"cna\": {\"title\": \"net/packet: fix slab-out-of-bounds access in packet_recvmsg()\", \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 7.8, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"AV:L - Exploitation requires a local AF_PACKET socket configured with PACKET_RX_RING (mmap) and PACKET_COPY_THRESH, then a local recvmsg/recvfrom; a remote packet alone cannot reach packet_recvmsg without that local setup.\\nAC:L - The attacker fully controls socket options, ring geometry, oversized-packet delivery (e.g. in their own netns), and the recvmsg that uses the bogus sll_halen; no race or victim-controlled precondition is required.\\nPR:L - packet_create() only checks ns_capable(net-\u003euser_ns, CAP_NET_RAW), which an unprivileged user obtains via user+network namespaces (unshare -Urn), matching established AF_PACKET scoring.\\nUI:N - The attacker performs socket setup, packet injection, and recvmsg entirely themselves; no separate victim action is required.\\nS:U - Impact is kernel stack/heap memory corruption and local privilege escalation within the same host kernel authority, not a VM/IOMMU/sandbox boundary escape.\\nC:H - Oversized memcpy from PACKET_SKB_CB (skb-\u003ecb) reads past the intended sockaddr into other sk_buff fields/adjacent memory and copies that data toward userspace via msg_name, yielding a high-impact kernel disclosure primitive.\\nI:H - The same path performs a kernel stack out-of-bounds write past sockaddr_storage in ____sys_recvmsg (observed write of size 165), which is an exploitable corruption primitive for control-flow hijacking.\\nA:H - The stack smash and subsequent move_addr_to_user BUG_ON(klen \u003e sizeof(sockaddr_storage)) cause kernel oops/panic, so availability impact is complete host crash.\"}]}], \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"0fb375fb9b93b7d822debc6a734052337ccfdb1f\", \"lessThan\": \"b9d5772d60f8e7ef34e290f72fc20e3a4883e7d0\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"0fb375fb9b93b7d822debc6a734052337ccfdb1f\", \"lessThan\": \"b1e27cda1e3c12b705875bb7e247a97168580e33\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"0fb375fb9b93b7d822debc6a734052337ccfdb1f\", \"lessThan\": \"a33dd1e6693f80d805155b3f69c18c2f642915da\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"0fb375fb9b93b7d822debc6a734052337ccfdb1f\", \"lessThan\": \"268dcf1f7b3193bc446ec3d14e08a240e9561e4d\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"0fb375fb9b93b7d822debc6a734052337ccfdb1f\", \"lessThan\": \"70b7b3c055fd4a464da8da55ff4c1f84269f9b02\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"0fb375fb9b93b7d822debc6a734052337ccfdb1f\", \"lessThan\": \"a055f5f2841f7522b44a2b1eccb1951b4b03d51a\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"0fb375fb9b93b7d822debc6a734052337ccfdb1f\", \"lessThan\": \"ef591b35176029fdefea38e8388ffa371e18f4b2\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"0fb375fb9b93b7d822debc6a734052337ccfdb1f\", \"lessThan\": \"c700525fcc06b05adfea78039de02628af79e07a\", \"versionType\": \"git\"}], \"programFiles\": [\"net/packet/af_packet.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"2.6.14\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"2.6.14\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"4.9.308\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"4.9.*\"}, {\"status\": \"unaffected\", \"version\": \"4.14.273\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"4.14.*\"}, {\"status\": \"unaffected\", \"version\": \"4.19.236\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"4.19.*\"}, {\"status\": \"unaffected\", \"version\": \"5.4.187\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.4.*\"}, {\"status\": \"unaffected\", \"version\": \"5.10.108\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.10.*\"}, {\"status\": \"unaffected\", \"version\": \"5.15.31\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.15.*\"}, {\"status\": \"unaffected\", \"version\": \"5.16.17\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.16.*\"}, {\"status\": \"unaffected\", \"version\": \"5.17\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"net/packet/af_packet.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/b9d5772d60f8e7ef34e290f72fc20e3a4883e7d0\"}, {\"url\": \"https://git.kernel.org/stable/c/b1e27cda1e3c12b705875bb7e247a97168580e33\"}, {\"url\": \"https://git.kernel.org/stable/c/a33dd1e6693f80d805155b3f69c18c2f642915da\"}, {\"url\": \"https://git.kernel.org/stable/c/268dcf1f7b3193bc446ec3d14e08a240e9561e4d\"}, {\"url\": \"https://git.kernel.org/stable/c/70b7b3c055fd4a464da8da55ff4c1f84269f9b02\"}, {\"url\": \"https://git.kernel.org/stable/c/a055f5f2841f7522b44a2b1eccb1951b4b03d51a\"}, {\"url\": \"https://git.kernel.org/stable/c/ef591b35176029fdefea38e8388ffa371e18f4b2\"}, {\"url\": \"https://git.kernel.org/stable/c/c700525fcc06b05adfea78039de02628af79e07a\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnet/packet: fix slab-out-of-bounds access in packet_recvmsg()\\n\\nsyzbot found that when an AF_PACKET socket is using PACKET_COPY_THRESH\\nand mmap operations, tpacket_rcv() is queueing skbs with\\ngarbage in skb-\u003ecb[], triggering a too big copy [1]\\n\\nPresumably, users of af_packet using mmap() already gets correct\\nmetadata from the mapped buffer, we can simply make sure\\nto clear 12 bytes that might be copied to user space later.\\n\\nBUG: KASAN: stack-out-of-bounds in memcpy include/linux/fortify-string.h:225 [inline]\\nBUG: KASAN: stack-out-of-bounds in packet_recvmsg+0x56c/0x1150 net/packet/af_packet.c:3489\\nWrite of size 165 at addr ffffc9000385fb78 by task syz-executor233/3631\\n\\nCPU: 0 PID: 3631 Comm: syz-executor233 Not tainted 5.17.0-rc7-syzkaller-02396-g0b3660695e80 #0\\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011\\nCall Trace:\\n \u003cTASK\u003e\\n __dump_stack lib/dump_stack.c:88 [inline]\\n dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106\\n print_address_description.constprop.0.cold+0xf/0x336 mm/kasan/report.c:255\\n __kasan_report mm/kasan/report.c:442 [inline]\\n kasan_report.cold+0x83/0xdf mm/kasan/report.c:459\\n check_region_inline mm/kasan/generic.c:183 [inline]\\n kasan_check_range+0x13d/0x180 mm/kasan/generic.c:189\\n memcpy+0x39/0x60 mm/kasan/shadow.c:66\\n memcpy include/linux/fortify-string.h:225 [inline]\\n packet_recvmsg+0x56c/0x1150 net/packet/af_packet.c:3489\\n sock_recvmsg_nosec net/socket.c:948 [inline]\\n sock_recvmsg net/socket.c:966 [inline]\\n sock_recvmsg net/socket.c:962 [inline]\\n ____sys_recvmsg+0x2c4/0x600 net/socket.c:2632\\n ___sys_recvmsg+0x127/0x200 net/socket.c:2674\\n __sys_recvmsg+0xe2/0x1a0 net/socket.c:2704\\n do_syscall_x64 arch/x86/entry/common.c:50 [inline]\\n do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80\\n entry_SYSCALL_64_after_hwframe+0x44/0xae\\nRIP: 0033:0x7fdfd5954c29\\nCode: 28 00 00 00 75 05 48 83 c4 28 c3 e8 41 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 \u003c48\u003e 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48\\nRSP: 002b:00007ffcf8e71e48 EFLAGS: 00000246 ORIG_RAX: 000000000000002f\\nRAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fdfd5954c29\\nRDX: 0000000000000000 RSI: 0000000020000500 RDI: 0000000000000005\\nRBP: 0000000000000000 R08: 000000000000000d R09: 000000000000000d\\nR10: 0000000000000000 R11: 0000000000000246 R12: 00007ffcf8e71e60\\nR13: 00000000000f4240 R14: 000000000000c1ff R15: 00007ffcf8e71e54\\n \u003c/TASK\u003e\\n\\naddr ffffc9000385fb78 is located in stack of task syz-executor233/3631 at offset 32 in frame:\\n ____sys_recvmsg+0x0/0x600 include/linux/uio.h:246\\n\\nthis frame has 1 object:\\n [32, 160) \u0027addr\u0027\\n\\nMemory state around the buggy address:\\n ffffc9000385fa80: 00 04 f3 f3 f3 f3 f3 00 00 00 00 00 00 00 00 00\\n ffffc9000385fb00: 00 00 00 00 00 00 00 00 00 00 00 f1 f1 f1 f1 00\\n\u003effffc9000385fb80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f3\\n                                                                ^\\n ffffc9000385fc00: f3 f3 f3 00 00 00 00 00 00 00 00 00 00 00 00 f1\\n ffffc9000385fc80: f1 f1 f1 00 f2 f2 f2 00 f2 f2 f2 00 00 00 00 00\\n==================================================================\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"4.9.308\", \"versionStartIncluding\": \"2.6.14\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"4.14.273\", \"versionStartIncluding\": \"2.6.14\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"4.19.236\", \"versionStartIncluding\": \"2.6.14\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.4.187\", \"versionStartIncluding\": \"2.6.14\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.10.108\", \"versionStartIncluding\": \"2.6.14\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.15.31\", \"versionStartIncluding\": \"2.6.14\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.16.17\", \"versionStartIncluding\": \"2.6.14\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.17\", \"versionStartIncluding\": \"2.6.14\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-08-05T08:52:36.447Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2022-48839\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-05T08:52:36.447Z\", \"dateReserved\": \"2024-07-16T11:38:08.909Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-07-16T12:25:10.521Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.