CVE-2022-48651

Q: What is the severity of CVE-2022-48651?

CVE-2022-48651 has a CVSS score of 7.7 (HIGH). A kernel memory corruption vulnerability in Linux ipvlan driver allows local attackers to trigger out-of-bounds memory access, potentially leading to system crashes or privilege escalation. This affects systems using ipvlan network interfaces with AF_PACKET sockets configured to bypass the network queueing discipline.

7.7 HIGH

📋 TL;DR

A kernel memory corruption vulnerability in Linux ipvlan driver allows local attackers to trigger out-of-bounds memory access, potentially leading to system crashes or privilege escalation. This affects systems using ipvlan network interfaces with AF_PACKET sockets configured to bypass the network queueing discipline.

💻 Affected Systems

Products:

Linux kernel

Versions: Kernel versions before the fix commits (specific versions vary by distribution)

Operating Systems: Linux distributions using vulnerable kernel versions

Default Config Vulnerable: ✅ No

Notes: Requires ipvlan interface usage AND AF_PACKET sockets with PACKET_QDISC_BYPASS option enabled via setsockopt().

📦 What is this software?

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Kernel panic leading to denial of service, or potential privilege escalation if memory corruption can be controlled to execute arbitrary code.

🟠

Likely Case

System crash or kernel panic causing denial of service on affected systems.

🟢

If Mitigated

No impact if ipvlan is not used or PACKET_QDISC_BYPASS is not enabled on AF_PACKET sockets.

🌐 Internet-Facing: LOW - Requires local access or ability to create AF_PACKET sockets with specific configuration.

🏢 Internal Only: MEDIUM - Local users or processes with CAP_NET_RAW capability can potentially exploit this to crash systems.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ✅ No

Complexity: MEDIUM

Requires local access and ability to create AF_PACKET sockets with specific socket options. Exploit would need to control memory corruption for privilege escalation.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Kernel versions with commits 25efdbe5fe542c3063d1948cc4e98abcb57621ca or later

Vendor Advisory: https://git.kernel.org/stable/c/25efdbe5fe542c3063d1948cc4e98abcb57621ca

Restart Required: Yes

Instructions:

1. Update Linux kernel to version containing the fix commit. 2. Check distribution security advisories for specific patched versions. 3. Reboot system to load new kernel.

🔧 Temporary Workarounds

Disable ipvlan usage

linux

Remove or disable ipvlan network interfaces if not required

ip link delete <ipvlan_interface>
modprobe -r ipvlan

Restrict AF_PACKET socket creation

linux

Limit CAP_NET_RAW capability to prevent unprivileged users from creating raw sockets

setcap -r /bin/ping
sysctl -w net.core.bpf_jit_enable=0

🧯 If You Can't Patch

Disable ipvlan kernel module loading: add 'blacklist ipvlan' to /etc/modprobe.d/
Implement strict capability management to prevent unprivileged users from obtaining CAP_NET_RAW

🔍 How to Verify

Check if Vulnerable:

Check if ipvlan module is loaded: lsmod | grep ipvlan AND check kernel version against patched versions

Check Version:

uname -r

Verify Fix Applied:

Verify kernel version includes fix commit: grep -q '25efdbe5fe542c3063d1948cc4e98abcb57621ca' /proc/version_signature || uname -r

📡 Detection & Monitoring

Log Indicators:

Kernel panic messages
KASAN reports of slab-out-of-bounds in ipvlan_xmit_mode_l2
System crashes with ipvlan-related stack traces

Network Indicators:

Unexpected traffic from ipvlan interfaces
AF_PACKET socket creation with PACKET_QDISC_BYPASS option

SIEM Query:

process_name:raw_send AND module:ipvlan OR event_type:kernel_panic AND component:ipvlan

📊 Metadata

CVE ID: CVE-2022-48651

CVSS v3 Score: 7.7 (HIGH)

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

CWE: CWE-125

Published: April 28, 2024

Last Updated: March 20, 2025

📋 TL;DR

💻 Affected Systems

📦 What is this software?

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

⚠️ Risk & Real-World Impact

Worst Case

Likely Case

If Mitigated

🎯 Exploit Status

🛠️ Fix & Mitigation

✅ Official Fix

Instructions:

🔧 Temporary Workarounds

Disable ipvlan usage

Restrict AF_PACKET socket creation

🧯 If You Can't Patch

🔍 How to Verify

Check if Vulnerable:

Check Version:

Verify Fix Applied:

📡 Detection & Monitoring

Log Indicators:

Network Indicators:

SIEM Query:

📊 Metadata

🔗 References

📤 Share & Export

🔗 Related Vulnerabilities