CVE-2022-48809

  1. Yack CVE
  2. Vulnerabilities (CVE)
  3. CVE-2022-48809

5.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

I

n the Linux kernel, the following vulnerability has been resolved: net: fix a memleak when uncloning an skb dst and its metadata When uncloning an skb dst and its associated metadata, a new dst+metadata is allocated and later replaces the old one in the skb. This is helpful to have a non-shared dst+metadata attached to a specific skb. The issue is the uncloned dst+metadata is initialized with a refcount of 1, which is increased to 2 before attaching it to the skb. When tun_dst_unclone returns, the dst+metadata is only referenced from a single place (the skb) while its refcount is 2. Its refcount will never drop to 0 (when the skb is consumed), leading to a memory leak. Fix this by removing the call to dst_hold in tun_dst_unclone, as the dst+metadata refcount is already 1.

References
Link Resource
https://git.kernel.org/stable/c/00e6d6c3bc14dfe32824e2c515f0e0f2d6ecf2f1 Patch
https://git.kernel.org/stable/c/0be943916d781df2b652793bb2d3ae4f9624c10a Patch
https://git.kernel.org/stable/c/4ac84498fbe84a00e7aef185e2bb3e40ce71eca4 Patch
https://git.kernel.org/stable/c/8b1087b998e273f07be13dcb5f3ca4c309c7f108 Patch
https://git.kernel.org/stable/c/9eeabdf17fa0ab75381045c867c370f4cc75a613 Patch
https://git.kernel.org/stable/c/a80817adc2a4c1ba26a7aa5f3ed886e4a18dff88 Patch
https://git.kernel.org/stable/c/c1ff27d100e2670b03cbfddb9117e5f9fc672540 Patch
https://git.kernel.org/stable/c/fdcb263fa5cda15b8cb24a641fa2718c47605314 Patch
https://git.kernel.org/stable/c/00e6d6c3bc14dfe32824e2c515f0e0f2d6ecf2f1 Patch
https://git.kernel.org/stable/c/0be943916d781df2b652793bb2d3ae4f9624c10a Patch
https://git.kernel.org/stable/c/4ac84498fbe84a00e7aef185e2bb3e40ce71eca4 Patch
https://git.kernel.org/stable/c/8b1087b998e273f07be13dcb5f3ca4c309c7f108 Patch
https://git.kernel.org/stable/c/9eeabdf17fa0ab75381045c867c370f4cc75a613 Patch
https://git.kernel.org/stable/c/a80817adc2a4c1ba26a7aa5f3ed886e4a18dff88 Patch
https://git.kernel.org/stable/c/c1ff27d100e2670b03cbfddb9117e5f9fc672540 Patch
https://git.kernel.org/stable/c/fdcb263fa5cda15b8cb24a641fa2718c47605314 Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
History

21 Nov 2024, 07:34

Type Values Removed Values Added
References () https://git.kernel.org/stable/c/00e6d6c3bc14dfe32824e2c515f0e0f2d6ecf2f1 - Patch () https://git.kernel.org/stable/c/00e6d6c3bc14dfe32824e2c515f0e0f2d6ecf2f1 - Patch
References () https://git.kernel.org/stable/c/0be943916d781df2b652793bb2d3ae4f9624c10a - Patch () https://git.kernel.org/stable/c/0be943916d781df2b652793bb2d3ae4f9624c10a - Patch
References () https://git.kernel.org/stable/c/4ac84498fbe84a00e7aef185e2bb3e40ce71eca4 - Patch () https://git.kernel.org/stable/c/4ac84498fbe84a00e7aef185e2bb3e40ce71eca4 - Patch
References () https://git.kernel.org/stable/c/8b1087b998e273f07be13dcb5f3ca4c309c7f108 - Patch () https://git.kernel.org/stable/c/8b1087b998e273f07be13dcb5f3ca4c309c7f108 - Patch
References () https://git.kernel.org/stable/c/9eeabdf17fa0ab75381045c867c370f4cc75a613 - Patch () https://git.kernel.org/stable/c/9eeabdf17fa0ab75381045c867c370f4cc75a613 - Patch
References () https://git.kernel.org/stable/c/a80817adc2a4c1ba26a7aa5f3ed886e4a18dff88 - Patch () https://git.kernel.org/stable/c/a80817adc2a4c1ba26a7aa5f3ed886e4a18dff88 - Patch
References () https://git.kernel.org/stable/c/c1ff27d100e2670b03cbfddb9117e5f9fc672540 - Patch () https://git.kernel.org/stable/c/c1ff27d100e2670b03cbfddb9117e5f9fc672540 - Patch
References () https://git.kernel.org/stable/c/fdcb263fa5cda15b8cb24a641fa2718c47605314 - Patch () https://git.kernel.org/stable/c/fdcb263fa5cda15b8cb24a641fa2718c47605314 - Patch

07 Aug 2024, 19:18

Type Values Removed Values Added
Summary
  • (es) En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: net: soluciona un memleak al desaclonar un skb dst y sus metadatos Al desaclonar un skb dst y sus metadatos asociados, se asigna un nuevo dst+metadatos que luego reemplaza al antiguo en el skb. Esto es útil para tener metadatos dst+ no compartidos adjuntos a un skb específico. El problema es que los metadatos dst+ no clonados se inicializan con un recuento de 1, que se incrementa a 2 antes de adjuntarlo al skb. Cuando tun_dst_unclone regresa, solo se hace referencia a los metadatos dst+ desde un único lugar (el skb) mientras su refcount es 2. Su refcount nunca bajará a 0 (cuando se consume el skb), lo que provoca una pérdida de memoria. Solucione este problema eliminando la llamada a dst_hold en tun_dst_unclone, ya que el recuento de metadatos dst+ ya es 1.
References () https://git.kernel.org/stable/c/00e6d6c3bc14dfe32824e2c515f0e0f2d6ecf2f1 - () https://git.kernel.org/stable/c/00e6d6c3bc14dfe32824e2c515f0e0f2d6ecf2f1 - Patch
References () https://git.kernel.org/stable/c/0be943916d781df2b652793bb2d3ae4f9624c10a - () https://git.kernel.org/stable/c/0be943916d781df2b652793bb2d3ae4f9624c10a - Patch
References () https://git.kernel.org/stable/c/4ac84498fbe84a00e7aef185e2bb3e40ce71eca4 - () https://git.kernel.org/stable/c/4ac84498fbe84a00e7aef185e2bb3e40ce71eca4 - Patch
References () https://git.kernel.org/stable/c/8b1087b998e273f07be13dcb5f3ca4c309c7f108 - () https://git.kernel.org/stable/c/8b1087b998e273f07be13dcb5f3ca4c309c7f108 - Patch
References () https://git.kernel.org/stable/c/9eeabdf17fa0ab75381045c867c370f4cc75a613 - () https://git.kernel.org/stable/c/9eeabdf17fa0ab75381045c867c370f4cc75a613 - Patch
References () https://git.kernel.org/stable/c/a80817adc2a4c1ba26a7aa5f3ed886e4a18dff88 - () https://git.kernel.org/stable/c/a80817adc2a4c1ba26a7aa5f3ed886e4a18dff88 - Patch
References () https://git.kernel.org/stable/c/c1ff27d100e2670b03cbfddb9117e5f9fc672540 - () https://git.kernel.org/stable/c/c1ff27d100e2670b03cbfddb9117e5f9fc672540 - Patch
References () https://git.kernel.org/stable/c/fdcb263fa5cda15b8cb24a641fa2718c47605314 - () https://git.kernel.org/stable/c/fdcb263fa5cda15b8cb24a641fa2718c47605314 - Patch
CWE CWE-401
CPE cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
First Time Linux linux Kernel
Linux
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.5

16 Jul 2024, 12:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-07-16 12:15

Updated : 2024-11-21 07:34

NVD link : CVE-2022-48809

Mitre link : CVE-2022-48809

CVE.ORG link : CVE-2022-48809

JSON object : View

Products Affected

linux

CWE
CWE-401

Missing Release of Memory after Effective Lifetime