CVE-2022-49197
📋 TL;DR
This is a Linux kernel vulnerability in the netlink subsystem where an out-of-bounds shift occurs when processing multicast group IDs above 32. This can cause undefined behavior including potential kernel crashes or incorrect group membership reporting. It affects Linux systems using netlink sockets with multicast groups.
💻 Affected Systems
- Linux Kernel
📦 What is this software?
Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →⚠️ Risk & Real-World Impact
Worst Case
Kernel panic or system crash leading to denial of service, potentially exploitable for privilege escalation if combined with other vulnerabilities.
Likely Case
Kernel crash or system instability when specific netlink multicast operations are performed, resulting in denial of service.
If Mitigated
Minor system instability or incorrect group reporting that doesn't affect core functionality.
🎯 Exploit Status
Proof of concept exists in the CVE description. Requires local access or ability to trigger specific netlink operations.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Kernel versions with commits: 0caf6d9922192dd1afa8dc2131abfb4df1443b9f, 41249fff507387c3323b198d0052faed08b14de4, 7409ff6393a67ff9838d0ae1bd102fb5f020d07a, ac5883a8890a11c00b32a19949a25d4afeaa2f5a, b0898362188e05b2202656058cc32d98fabf3bac
Vendor Advisory: https://git.kernel.org/stable/c/0caf6d9922192dd1afa8dc2131abfb4df1443b9f
Restart Required: Yes
Instructions:
1. Update Linux kernel to patched version from your distribution. 2. Reboot system to load new kernel. 3. Verify kernel version after reboot.
🔧 Temporary Workarounds
Disable bridge monitoring
linuxPrevent triggering the vulnerability by avoiding bridge vlan monitoring operations
Avoid running: bridge monitor vlan
Avoid: ip link add name br type bridge with monitoring
Use NETLINK_PKTINFO for high groups
linuxConfigure applications to use nl_pktinfo control messages for groups >= 32 as recommended
Set NETLINK_PKTINFO socket option in applications
🧯 If You Can't Patch
- Restrict local user access to systems using netlink sockets
- Monitor for bridge monitoring commands and block them
🔍 How to Verify
Check if Vulnerable:
Check kernel version and compare with patched versions from your distribution. Vulnerable if using kernel before fix commits.Check Version:
uname -rVerify Fix Applied:
Verify kernel version includes one of the fix commits: 0caf6d9922192dd1afa8dc2131abfb4df1443b9f or related commits📡 Detection & Monitoring
Log Indicators:
- Kernel logs showing: UBSAN: shift-out-of-bounds in net/netlink/af_netlink.c
- System crash logs related to netlink operations
Network Indicators:
- Netlink socket traffic with high group IDs
- Bridge monitoring network traffic
SIEM Query:
search 'UBSAN shift-out-of-bounds af_netlink' OR 'bridge monitor vlan' in system logs🔗 References
- https://git.kernel.org/stable/c/0caf6d9922192dd1afa8dc2131abfb4df1443b9f
- https://git.kernel.org/stable/c/41249fff507387c3323b198d0052faed08b14de4
- https://git.kernel.org/stable/c/7409ff6393a67ff9838d0ae1bd102fb5f020d07a
- https://git.kernel.org/stable/c/ac5883a8890a11c00b32a19949a25d4afeaa2f5a
- https://git.kernel.org/stable/c/b0898362188e05b2202656058cc32d98fabf3bac
- https://git.kernel.org/stable/c/e1c5d46f05aa23d740daae5cd3a6472145afac42
- https://git.kernel.org/stable/c/e23e1e981247feb3c7d0236fe58aceb685f234ae
- https://git.kernel.org/stable/c/e8aaf3134bc5e943048eefe9f2ddaabf41d92b1a
- https://git.kernel.org/stable/c/f75f4abeec4c04b600a15b50c89a481f1e7435ee
