CVE-2022-48654

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2022-48654
In the Linux kernel, the following vulnerability has been resolved: netfilter: nfnetlink_osf: fix possible bogus match in nf_osf_find() nf_osf_find() incorrectly returns true on mismatch, this leads to copying uninitialized memory area in nft_osf which can be used to leak stale kernel stack data to userspace.

5.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/559c36c5a8d730c49ef805a72b213d3bba155cc8 Patch
https://git.kernel.org/stable/c/5d75fef3e61e797fab5c3fbba88caa74ab92ad47 Patch
https://git.kernel.org/stable/c/633c81c0449663f57d4138326d036dc6cfad674e Patch
https://git.kernel.org/stable/c/721ea8ac063d70c2078c4e762212705de6151764 Patch
https://git.kernel.org/stable/c/816eab147e5c6f6621922b8515ad9010ceb1735e Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
History

23 May 2024, 19:01

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.5
CPE cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
First Time Linux linux Kernel
Linux
References () https://git.kernel.org/stable/c/559c36c5a8d730c49ef805a72b213d3bba155cc8 - () https://git.kernel.org/stable/c/559c36c5a8d730c49ef805a72b213d3bba155cc8 - Patch
References () https://git.kernel.org/stable/c/5d75fef3e61e797fab5c3fbba88caa74ab92ad47 - () https://git.kernel.org/stable/c/5d75fef3e61e797fab5c3fbba88caa74ab92ad47 - Patch
References () https://git.kernel.org/stable/c/633c81c0449663f57d4138326d036dc6cfad674e - () https://git.kernel.org/stable/c/633c81c0449663f57d4138326d036dc6cfad674e - Patch
References () https://git.kernel.org/stable/c/721ea8ac063d70c2078c4e762212705de6151764 - () https://git.kernel.org/stable/c/721ea8ac063d70c2078c4e762212705de6151764 - Patch
References () https://git.kernel.org/stable/c/816eab147e5c6f6621922b8515ad9010ceb1735e - () https://git.kernel.org/stable/c/816eab147e5c6f6621922b8515ad9010ceb1735e - Patch
Summary
  • (es) En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: netfilter: nfnetlink_osf: corrige una posible coincidencia falsa en nf_osf_find() nf_osf_find() devuelve verdadero incorrectamente en caso de discrepancia, esto lleva a copiar el área de memoria no inicializada en nft_osf que puede usarse para filtrar el kernel obsoleto apilar datos en el espacio de usuario.
CWE CWE-908

28 Apr 2024, 13:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-04-28 13:15

Updated : 2024-05-23 19:01

NVD link : CVE-2022-48654

Mitre link : CVE-2022-48654

CVE.ORG link : CVE-2022-48654

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
CWE-908

Use of Uninitialized Resource