CVE-2022-48807

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2022-48807
In the Linux kernel, the following vulnerability has been resolved: ice: Fix KASAN error in LAG NETDEV_UNREGISTER handler Currently, the same handler is called for both a NETDEV_BONDING_INFO LAG unlink notification as for a NETDEV_UNREGISTER call. This is causing a problem though, since the netdev_notifier_info passed has a different structure depending on which event is passed. The problem manifests as a call trace from a BUG: KASAN stack-out-of-bounds error. Fix this by creating a handler specific to NETDEV_UNREGISTER that only is passed valid elements in the netdev_notifier_info struct for the NETDEV_UNREGISTER event. Also included is the removal of an unbalanced dev_put on the peer_netdev and related braces.

5.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/bea1898f65b9b7096cb4e73e97c83b94718f1fa1 Patch
https://git.kernel.org/stable/c/f9daedc3ab8f673e3a9374b91a89fbf1174df469 Patch
https://git.kernel.org/stable/c/faa9bcf700ca1a0d09f92502a6b65d3ce313fb46 Patch
https://git.kernel.org/stable/c/bea1898f65b9b7096cb4e73e97c83b94718f1fa1 Patch
https://git.kernel.org/stable/c/f9daedc3ab8f673e3a9374b91a89fbf1174df469 Patch
https://git.kernel.org/stable/c/faa9bcf700ca1a0d09f92502a6b65d3ce313fb46 Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.15:-:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.17:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.17:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.17:rc3:*:*:*:*:*:*
History

25 Sep 2025, 19:38

Type Values Removed Values Added
References () https://git.kernel.org/stable/c/bea1898f65b9b7096cb4e73e97c83b94718f1fa1 - () https://git.kernel.org/stable/c/bea1898f65b9b7096cb4e73e97c83b94718f1fa1 - Patch
References () https://git.kernel.org/stable/c/f9daedc3ab8f673e3a9374b91a89fbf1174df469 - () https://git.kernel.org/stable/c/f9daedc3ab8f673e3a9374b91a89fbf1174df469 - Patch
References () https://git.kernel.org/stable/c/faa9bcf700ca1a0d09f92502a6b65d3ce313fb46 - () https://git.kernel.org/stable/c/faa9bcf700ca1a0d09f92502a6b65d3ce313fb46 - Patch
CPE cpe:2.3:o:linux:linux_kernel:5.17:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.17:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.15:-:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.17:rc1:*:*:*:*:*:*
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.5
CWE CWE-908
First Time Linux linux Kernel
Linux

21 Nov 2024, 07:34

Type Values Removed Values Added
Summary
  • (es) En el kernel de Linux se ha resuelto la siguiente vulnerabilidad: ice: Solucionar error KASAN en el controlador LAG NETDEV_UNREGISTER Actualmente, se llama al mismo controlador tanto para una notificación de desvinculación de NETDEV_BONDING_INFO LAG como para una llamada NETDEV_UNREGISTER. Sin embargo, esto está causando un problema, ya que el netdev_notifier_info pasado tiene una estructura diferente según el evento que se pasa. El problema se manifiesta como un seguimiento de llamada de un ERROR: error de pila fuera de los límites de KASAN. Solucione este problema creando un controlador específico para NETDEV_UNREGISTER al que solo se le pasan elementos válidos en la estructura netdev_notifier_info para el evento NETDEV_UNREGISTER. También se incluye la eliminación de un dev_put desequilibrado en peer_netdev y llaves relacionadas.
References () https://git.kernel.org/stable/c/bea1898f65b9b7096cb4e73e97c83b94718f1fa1 - () https://git.kernel.org/stable/c/bea1898f65b9b7096cb4e73e97c83b94718f1fa1 -
References () https://git.kernel.org/stable/c/f9daedc3ab8f673e3a9374b91a89fbf1174df469 - () https://git.kernel.org/stable/c/f9daedc3ab8f673e3a9374b91a89fbf1174df469 -
References () https://git.kernel.org/stable/c/faa9bcf700ca1a0d09f92502a6b65d3ce313fb46 - () https://git.kernel.org/stable/c/faa9bcf700ca1a0d09f92502a6b65d3ce313fb46 -

16 Jul 2024, 12:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-07-16 12:15

Updated : 2025-09-25 19:38

NVD link : CVE-2022-48807

Mitre link : CVE-2022-48807

CVE.ORG link : CVE-2022-48807

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
CWE-908

Use of Uninitialized Resource