CVE-2022-48654 : In the Linux kernel, the following vulnerability has been resolved: netfilter:

In the Linux kernel, the following vulnerability has been resolved: netfilter: nfnetlink_osf: fix possible bogus match in nf_osf_find() nf_osf_find() incorrectly returns true on mismatch, this leads to copying uninitialized memory area in nft_osf which can be used to leak stale kernel stack data to userspace.

Published 2024-04-28 13:15:08

Updated 2024-10-30 16:35:04

Source Linux

View at NVD, CVE.org

Products affected by CVE-2022-48654

Linux » Linux Kernel
Versions from including (>=) 5.11.0 and before (<) 5.15.71
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Matching versions
Linux » Linux Kernel
Versions from including (>=) 5.16.0 and before (<) 5.19.12
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Matching versions
Linux » Linux Kernel
Versions from including (>=) 5.2.0 and before (<) 5.4.215
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Matching versions
Linux » Linux Kernel
Versions from including (>=) 5.5.0 and before (<) 5.10.146
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Matching versions

Exploit prediction scoring system (EPSS) score for CVE-2022-48654

EPSS FAQ

0.07%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 19 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2022-48654

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source	First Seen
5.3	MEDIUM	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L	1.8	3.4	134c704f-9b21-4f2e-91b3-4a467353bcc0	2024-10-30
Attack Vector: Local Attack Complexity: Low Privileges Required: Low User Interaction: None Scope: Unchanged Confidentiality: Low Integrity: Low Availability: Low
5.5	MEDIUM	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N	1.8	3.6	NIST	2024-05-23
Attack Vector: Local Attack Complexity: Low Privileges Required: Low User Interaction: None Scope: Unchanged Confidentiality: High Integrity: None Availability: None

CWE ids for CVE-2022-48654

CWE-908 Use of Uninitialized Resource

The product uses or accesses a resource that has not been initialized.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2022-48654

https://git.kernel.org/stable/c/633c81c0449663f57d4138326d036dc6cfad674e

netfilter: nfnetlink_osf: fix possible bogus match in nf_osf_find() - kernel/git/stable/linux.git - Linux kernel stable tree
Patch
https://git.kernel.org/stable/c/816eab147e5c6f6621922b8515ad9010ceb1735e

netfilter: nfnetlink_osf: fix possible bogus match in nf_osf_find() - kernel/git/stable/linux.git - Linux kernel stable tree
Patch
https://git.kernel.org/stable/c/721ea8ac063d70c2078c4e762212705de6151764

netfilter: nfnetlink_osf: fix possible bogus match in nf_osf_find() - kernel/git/stable/linux.git - Linux kernel stable tree
Patch
https://git.kernel.org/stable/c/5d75fef3e61e797fab5c3fbba88caa74ab92ad47

netfilter: nfnetlink_osf: fix possible bogus match in nf_osf_find() - kernel/git/stable/linux.git - Linux kernel stable tree
Patch
https://git.kernel.org/stable/c/559c36c5a8d730c49ef805a72b213d3bba155cc8

netfilter: nfnetlink_osf: fix possible bogus match in nf_osf_find() - kernel/git/stable/linux.git - Linux kernel stable tree
Patch

Jump to

Vulnerability Details : CVE-2022-48654

Products affected by CVE-2022-48654

Exploit prediction scoring system (EPSS) score for CVE-2022-48654

CVSS scores for CVE-2022-48654

CWE ids for CVE-2022-48654

References for CVE-2022-48654