CVE-2022-48757 – This CVE allows information leakage across Linu... (How to Fix)

Q: What is the severity of CVE-2022-48757?

CVE-2022-48757 has a CVSS score of 7.1 (HIGH). This CVE allows information leakage across Linux network namespaces. When a packet socket is created without binding to a device in one namespace, users in other namespaces can observe the new packet_type by reading /proc/net/ptype. This affects Linux systems using network namespaces with unprivileged users who can access /proc/net/ptype.

📋 TL;DR

This CVE allows information leakage across Linux network namespaces. When a packet socket is created without binding to a device in one namespace, users in other namespaces can observe the new packet_type by reading /proc/net/ptype. This affects Linux systems using network namespaces with unprivileged users who can access /proc/net/ptype.

💻 Affected Systems

Products:

Linux kernel

Versions: Versions before the fix commits (specific versions vary by distribution)

Operating Systems: Linux distributions using affected kernel versions

Default Config Vulnerable: ⚠️ Yes

Notes: Requires network namespaces to be in use and users with access to /proc/net/ptype. Container environments (Docker, Kubernetes) using network namespaces are particularly relevant.

📦 What is this software?

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

⚠️ Risk & Real-World Impact

🔴

Worst Case

An attacker could map network namespace configurations and identify packet socket usage patterns, potentially aiding in privilege escalation or lateral movement attacks by understanding network isolation boundaries.

🟠

Likely Case

Information disclosure about network namespace configurations, revealing what types of packet sockets exist in other namespaces, which could help attackers understand system architecture.

🟢

If Mitigated

Minimal impact - only reveals existence of packet sockets without binding, no data exfiltration or system compromise.

🌐 Internet-Facing: LOW - This requires access to /proc filesystem which is typically not exposed to internet-facing services.

🏢 Internal Only: MEDIUM - Internal users with access to /proc/net/ptype could gain information about network namespace configurations they shouldn't see.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: NO

Unauthenticated Exploit: ✅ No

Complexity: LOW

Exploitation is straightforward - simply reading /proc/net/ptype from a different namespace. However, this is information disclosure only, not a system compromise.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Fixed in kernel commits: 47934e06b65637c88a762d9c98329ae6e3238888, 839ec7039513a4f84bfbaff953a9393471176bee, 8f88c78d24f6f346919007cd459fd7e51a8c7779, b67ad6170c0ea87391bb253f35d1f78857736e54, be1ca30331c7923c6f376610c1bd6059be9b1908

Vendor Advisory: https://git.kernel.org/stable/c/47934e06b65637c88a762d9c98329ae6e3238888

Restart Required: Yes

Instructions:

1. Update Linux kernel to version containing the fix commits. 2. Check your distribution's security advisories for specific patched versions. 3. Reboot the system to load the new kernel.

🔧 Temporary Workarounds

Restrict /proc/net/ptype access

linux

Limit access to /proc/net/ptype file to prevent unauthorized users from reading it

chmod 600 /proc/net/ptype
chown root:root /proc/net/ptype

Use namespaced /proc

linux

Ensure /proc is properly namespaced so users cannot see other namespaces' /proc/net/ptype

🧯 If You Can't Patch

Implement strict access controls on /proc filesystem
Isolate network namespaces and ensure users cannot access other namespaces' /proc/net/ptype

🔍 How to Verify

Check if Vulnerable:

Check if you can read /proc/net/ptype from a different network namespace and see packet_type entries from other namespaces

Check Version:

uname -r

Verify Fix Applied:

After patching, verify that /proc/net/ptype only shows packet_type entries from the current namespace

📡 Detection & Monitoring

Log Indicators:

Unusual access patterns to /proc/net/ptype
Multiple users accessing /proc/net/ptype across namespaces

SIEM Query:

process.name="cat" AND file.path="/proc/net/ptype" OR process.name="less" AND file.path="/proc/net/ptype"

📊 Metadata

CVE ID: CVE-2022-48757

CVSS v3 Score: 7.1 (HIGH)

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

CWE: CWE-668

Published: June 20, 2024

Last Updated: September 17, 2025

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2022-48757, you might also want to check these: