CVE-2022-49084

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2022-49084
In the Linux kernel, the following vulnerability has been resolved: qede: confirm skb is allocated before using qede_build_skb() assumes build_skb() always works and goes straight to skb_reserve(). However, build_skb() can fail under memory pressure. This results in a kernel panic because the skb to reserve is NULL. Add a check in case build_skb() failed to allocate and return NULL. The NULL return is handled correctly in callers to qede_build_skb().

5.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/034a92c6a81048128fc7b18d278d52438a13902a Patch
https://git.kernel.org/stable/c/4e910dbe36508654a896d5735b318c0b88172570 Patch
https://git.kernel.org/stable/c/8928239e5e2e460d95b8a0b89f61671625e7ece0 Patch
https://git.kernel.org/stable/c/9648adb1b3ece55c657d3a4f52bfee663b710dfe Patch
https://git.kernel.org/stable/c/b2d6b3db9d1cf80908964036dbe1c52a86b1afb1 Patch
https://git.kernel.org/stable/c/c9bdce2359b5f4986eb38d1e81865b3586cc20d2 Patch
https://git.kernel.org/stable/c/e1fd0c42acfa22bb34d2ab6a111484f466ab8093 Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.18:rc1:*:*:*:*:*:*
History

23 Sep 2025, 18:33

Type Values Removed Values Added
First Time Linux linux Kernel
Linux
CWE CWE-476
References () https://git.kernel.org/stable/c/034a92c6a81048128fc7b18d278d52438a13902a - () https://git.kernel.org/stable/c/034a92c6a81048128fc7b18d278d52438a13902a - Patch
References () https://git.kernel.org/stable/c/4e910dbe36508654a896d5735b318c0b88172570 - () https://git.kernel.org/stable/c/4e910dbe36508654a896d5735b318c0b88172570 - Patch
References () https://git.kernel.org/stable/c/8928239e5e2e460d95b8a0b89f61671625e7ece0 - () https://git.kernel.org/stable/c/8928239e5e2e460d95b8a0b89f61671625e7ece0 - Patch
References () https://git.kernel.org/stable/c/9648adb1b3ece55c657d3a4f52bfee663b710dfe - () https://git.kernel.org/stable/c/9648adb1b3ece55c657d3a4f52bfee663b710dfe - Patch
References () https://git.kernel.org/stable/c/b2d6b3db9d1cf80908964036dbe1c52a86b1afb1 - () https://git.kernel.org/stable/c/b2d6b3db9d1cf80908964036dbe1c52a86b1afb1 - Patch
References () https://git.kernel.org/stable/c/c9bdce2359b5f4986eb38d1e81865b3586cc20d2 - () https://git.kernel.org/stable/c/c9bdce2359b5f4986eb38d1e81865b3586cc20d2 - Patch
References () https://git.kernel.org/stable/c/e1fd0c42acfa22bb34d2ab6a111484f466ab8093 - () https://git.kernel.org/stable/c/e1fd0c42acfa22bb34d2ab6a111484f466ab8093 - Patch
CPE cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.18:rc1:*:*:*:*:*:*
Summary
  • (es) En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: qede: confirmar que skb está asignado antes de usar qede_build_skb() supone que build_skb() siempre funciona y pasa directamente a skb_reserve(). Sin embargo, build_skb() puede fallar bajo presión de memoria. Esto da como resultado un pánico del kernel porque el skb a reservar es NULL. Agregue una verificación en caso de que build_skb() no pueda asignar y devuelva NULL. El retorno NULL se maneja correctamente en los llamadores a qede_build_skb().
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.5

26 Feb 2025, 07:00

Type Values Removed Values Added
New CVE
Information

Published : 2025-02-26 07:00

Updated : 2025-09-23 18:33

NVD link : CVE-2022-49084

Mitre link : CVE-2022-49084

CVE.ORG link : CVE-2022-49084

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
CWE-476

NULL Pointer Dereference