CVE-2022-48839
📋 TL;DR
A memory corruption vulnerability in the Linux kernel's AF_PACKET socket implementation allows local attackers to trigger slab-out-of-bounds access. When using PACKET_COPY_THRESH with mmap operations, uninitialized memory in skb->cb[] can be copied to userspace, potentially leaking kernel memory or causing crashes. This affects Linux systems with AF_PACKET sockets enabled.
💻 Affected Systems
- Linux kernel
📦 What is this software?
Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →⚠️ Risk & Real-World Impact
Worst Case
Kernel memory disclosure leading to information leakage, potential privilege escalation if combined with other vulnerabilities, or kernel panic causing system instability.
Likely Case
Information disclosure of kernel memory contents to local users, potentially revealing sensitive data or system information.
If Mitigated
Limited impact if AF_PACKET sockets are not used or restricted via capabilities/namespaces.
🎯 Exploit Status
Syzbot discovered and reported this vulnerability. Exploitation requires local access and specific AF_PACKET socket configuration.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Fixed in kernel commits: 268dcf1f7b3193bc446ec3d14e08a240e9561e4d and related stable backports
Vendor Advisory: https://git.kernel.org/stable/c/268dcf1f7b3193bc446ec3d14e08a240e9561e4d
Restart Required: Yes
Instructions:
1. Update Linux kernel to version containing the fix. 2. Check your distribution's security advisories for specific patched versions. 3. Reboot system after kernel update.
🔧 Temporary Workarounds
Restrict AF_PACKET socket usage
linuxLimit creation of AF_PACKET sockets using capabilities or namespaces
# Use capabilities: setcap -r /bin/ping
# Use namespaces: unshare -n
Disable unnecessary network protocols
linuxRemove AF_PACKET module if not needed
# Blacklist packet module: echo 'blacklist packet' >> /etc/modprobe.d/blacklist.conf
# Rebuild initramfs if needed
🧯 If You Can't Patch
- Implement strict access controls to prevent unauthorized users from creating AF_PACKET sockets
- Monitor for unusual AF_PACKET socket usage and investigate any unauthorized creation attempts
🔍 How to Verify
Check if Vulnerable:
Check kernel version and compare with distribution's patched versions. Vulnerable if using kernel before fix commits.Check Version:
uname -rVerify Fix Applied:
Verify kernel version is updated to patched version and check that the specific git commits are included in your kernel build.📡 Detection & Monitoring
Log Indicators:
- Kernel panic logs
- KASAN reports of slab-out-of-bounds access in packet_recvmsg
- Unusual AF_PACKET socket creation
Network Indicators:
- Local socket creation attempts for AF_PACKET protocol
SIEM Query:
process:name="syz-executor" OR kernel_log:"KASAN: stack-out-of-bounds" OR kernel_log:"packet_recvmsg"🔗 References
- https://git.kernel.org/stable/c/268dcf1f7b3193bc446ec3d14e08a240e9561e4d
- https://git.kernel.org/stable/c/70b7b3c055fd4a464da8da55ff4c1f84269f9b02
- https://git.kernel.org/stable/c/a055f5f2841f7522b44a2b1eccb1951b4b03d51a
- https://git.kernel.org/stable/c/a33dd1e6693f80d805155b3f69c18c2f642915da
- https://git.kernel.org/stable/c/b1e27cda1e3c12b705875bb7e247a97168580e33
- https://git.kernel.org/stable/c/b9d5772d60f8e7ef34e290f72fc20e3a4883e7d0
- https://git.kernel.org/stable/c/c700525fcc06b05adfea78039de02628af79e07a
- https://git.kernel.org/stable/c/ef591b35176029fdefea38e8388ffa371e18f4b2
- https://git.kernel.org/stable/c/268dcf1f7b3193bc446ec3d14e08a240e9561e4d
- https://git.kernel.org/stable/c/70b7b3c055fd4a464da8da55ff4c1f84269f9b02
- https://git.kernel.org/stable/c/a055f5f2841f7522b44a2b1eccb1951b4b03d51a
- https://git.kernel.org/stable/c/a33dd1e6693f80d805155b3f69c18c2f642915da
- https://git.kernel.org/stable/c/b1e27cda1e3c12b705875bb7e247a97168580e33
- https://git.kernel.org/stable/c/b9d5772d60f8e7ef34e290f72fc20e3a4883e7d0
- https://git.kernel.org/stable/c/c700525fcc06b05adfea78039de02628af79e07a
- https://git.kernel.org/stable/c/ef591b35176029fdefea38e8388ffa371e18f4b2
