CVE-2022-48956

Q: What is the severity of CVE-2022-48956?

CVE-2022-48956 has a CVSS score of 7.8 (HIGH). This is a use-after-free vulnerability in the Linux kernel's IPv6 fragmentation code that can lead to kernel memory corruption and potential privilege escalation. It affects Linux systems with IPv6 enabled, particularly when processing UDP packets that require fragmentation.

7.8 HIGH

Denial of Service

📋 TL;DR

This is a use-after-free vulnerability in the Linux kernel's IPv6 fragmentation code that can lead to kernel memory corruption and potential privilege escalation. It affects Linux systems with IPv6 enabled, particularly when processing UDP packets that require fragmentation.

💻 Affected Systems

Products:

Linux kernel

Versions: Linux kernel versions before the fix commits (specific versions vary by distribution)

Operating Systems: All Linux distributions with vulnerable kernel versions

Default Config Vulnerable: ⚠️ Yes

Notes: Requires IPv6 to be enabled and UDP traffic that triggers fragmentation. Not all configurations may be exploitable.

📦 What is this software?

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Kernel panic leading to system crash, or local privilege escalation to root via kernel memory corruption.

🟠

Likely Case

System instability, kernel crashes, or denial of service through kernel panics.

🟢

If Mitigated

Minimal impact if IPv6 is disabled or proper network filtering prevents malicious fragmentation.

🌐 Internet-Facing: MEDIUM - Requires sending specially crafted IPv6 UDP packets that trigger fragmentation.

🏢 Internal Only: MEDIUM - Same exploitation requirements but from internal network position.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ⚠️ Yes

Complexity: MEDIUM

Exploitation requires sending specially crafted IPv6 UDP packets that trigger the fragmentation path. The vulnerability was discovered through fuzzing (syzbot).

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Fixed in kernel commits: 6b6d3be3661bff2746cab26147bd629aa034e094 and related stable backports

Vendor Advisory: https://git.kernel.org/stable/c/6b6d3be3661bff2746cab26147bd629aa034e094

Restart Required: Yes

Instructions:

1. Update Linux kernel to patched version from your distribution. 2. For RHEL/CentOS: yum update kernel. 3. For Ubuntu/Debian: apt update && apt upgrade linux-image-*. 4. Reboot system to load new kernel.

🔧 Temporary Workarounds

Disable IPv6

linux

Completely disable IPv6 to prevent exploitation

echo 'net.ipv6.conf.all.disable_ipv6 = 1' >> /etc/sysctl.conf
echo 'net.ipv6.conf.default.disable_ipv6 = 1' >> /etc/sysctl.conf
sysctl -p

Block IPv6 fragmentation

linux

Use firewall rules to block IPv6 fragments

ip6tables -A INPUT -f -j DROP
ip6tables -A FORWARD -f -j DROP

🧯 If You Can't Patch

Implement strict network filtering to block IPv6 fragments at perimeter
Monitor systems for kernel panics or unusual crashes related to network processing

🔍 How to Verify

Check if Vulnerable:

Check kernel version: uname -r and compare with distribution's patched versions. Vulnerable if before fix commits.

Check Version:

uname -r

Verify Fix Applied:

Verify kernel version after update and ensure no kernel panics occur during IPv6 UDP fragmentation testing.

📡 Detection & Monitoring

Log Indicators:

Kernel panic messages in /var/log/messages or dmesg
Use-after-free KASAN reports in kernel logs
System crashes during network traffic

Network Indicators:

Unusual IPv6 fragmentation patterns
Malformed IPv6 UDP packets triggering fragmentation

SIEM Query:

source="kernel" AND ("KASAN: use-after-free" OR "ip6_fragment" OR "kernel panic")

📊 Metadata

CVE ID: CVE-2022-48956

CVSS v3 Score: 7.8 (HIGH)

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE: CWE-416

Published: October 21, 2024

Last Updated: October 24, 2024

📋 TL;DR

💻 Affected Systems

📦 What is this software?

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

⚠️ Risk & Real-World Impact

Worst Case

Likely Case

If Mitigated

🎯 Exploit Status

🛠️ Fix & Mitigation

✅ Official Fix

Instructions:

🔧 Temporary Workarounds

Disable IPv6

Block IPv6 fragmentation

🧯 If You Can't Patch

🔍 How to Verify

Check if Vulnerable:

Check Version:

Verify Fix Applied:

📡 Detection & Monitoring

Log Indicators:

Network Indicators:

SIEM Query:

📊 Metadata

🔗 References

📤 Share & Export

🔗 Related Vulnerabilities