by Kastro
Paper/Archive/CVE-2022-48686

CVE-2022-48686

Linux Linux — nvme-tcp: fix UAF when detecting digest errors

EPSS 0.7%CVSS 9.8
critical.is priorityof 100
40
CVSS 9.8 (CNA)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 53.3.533 × 2010.7No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

In the Linux kernel, the following vulnerability has been resolved: nvme-tcp: fix UAF when detecting digest errors We should also bail from the io_work loop when we set rd_enabled to true, so we don't attempt to read data from the socket when the TCP stream is already out-of-sync or corrupted.

Affected

ProductAffectedFixed inSource
Linux3f2304f8c6d6ed97849057bd16fee99e434ca796 – < 19816a0214684f70b49b25075ff8c402fdd611d319816a0214684f70b49b25075ff8c402fdd611d3CNA
Linux3f2304f8c6d6ed97849057bd16fee99e434ca796 – < 5914fa32ef1b7766fea933f9eed94ac5c00aa7ff5914fa32ef1b7766fea933f9eed94ac5c00aa7ffCNA
Linux3f2304f8c6d6ed97849057bd16fee99e434ca796 – < 13c80a6c112467bab5e44d090767930555fc17a513c80a6c112467bab5e44d090767930555fc17a5CNA
Linux3f2304f8c6d6ed97849057bd16fee99e434ca796 – < c3eb461aa56e6fa94fb80442ba2586bd223a8886c3eb461aa56e6fa94fb80442ba2586bd223a8886CNA
Linux3f2304f8c6d6ed97849057bd16fee99e434ca796 – < 160f3549a907a50e51a8518678ba2dcf2541abea160f3549a907a50e51a8518678ba2dcf2541abeaCNA
Linux5.05.4.213CNA

Scores by source

Linux (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADP6.2CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: partial

References

refgit.kernel.org/stable/c/19816a0214684f70b49b25075ff8c402fdd611d3refgit.kernel.org/stable/c/5914fa32ef1b7766fea933f9eed94ac5c00aa7ffrefgit.kernel.org/stable/c/13c80a6c112467bab5e44d090767930555fc17a5refgit.kernel.org/stable/c/c3eb461aa56e6fa94fb80442ba2586bd223a8886refgit.kernel.org/stable/c/160f3549a907a50e51a8518678ba2dcf2541abea