CVE-2022-49638

Q: What is the severity of CVE-2022-49638?

CVE-2022-49638 has a CVSS score of 4.7 (MEDIUM). This CVE describes a race condition vulnerability in the Linux kernel's ICMP protocol implementation where sysctl variables can be read while being modified concurrently, potentially leading to inconsistent system behavior. It affects Linux systems with vulnerable kernel versions. The vulnerability requires local access to exploit.

4.7 MEDIUM

📋 TL;DR

This CVE describes a race condition vulnerability in the Linux kernel's ICMP protocol implementation where sysctl variables can be read while being modified concurrently, potentially leading to inconsistent system behavior. It affects Linux systems with vulnerable kernel versions. The vulnerability requires local access to exploit.

💻 Affected Systems

Products:

Linux Kernel

Versions: Specific vulnerable versions not explicitly stated in CVE, but patches exist for multiple stable branches

Operating Systems: Linux distributions using affected kernel versions

Default Config Vulnerable: ⚠️ Yes

Notes: All Linux systems with vulnerable kernel versions are affected. The vulnerability is in the core ICMP implementation.

📦 What is this software?

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

⚠️ Risk & Real-World Impact

🔴

Worst Case

An attacker with local access could cause kernel instability, denial of service, or potentially leverage the race condition to bypass security controls by manipulating ICMP-related sysctl variables during concurrent operations.

🟠

Likely Case

Local privilege escalation or denial of service through kernel instability when ICMP sysctl variables are manipulated during concurrent operations.

🟢

If Mitigated

Minimal impact if proper access controls prevent unauthorized local users from modifying sysctl variables.

🌐 Internet-Facing: LOW - Requires local access to exploit, not directly exploitable over network.

🏢 Internal Only: MEDIUM - Local attackers could potentially exploit this to cause system instability or escalate privileges.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ✅ No

Complexity: MEDIUM

Exploitation requires local access and precise timing to trigger the race condition. No public exploits have been reported.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Multiple stable kernel versions with fixes: 0cba7ca667ceb06934746ddd9833a25847bde81d and others listed in references

Vendor Advisory: https://git.kernel.org/stable/c/0cba7ca667ceb06934746ddd9833a25847bde81d

Restart Required: Yes

Instructions:

1. Update Linux kernel to patched version from official kernel.org or distribution repositories. 2. Reboot system to load new kernel. 3. Verify kernel version after reboot.

🔧 Temporary Workarounds

Restrict sysctl access

linux

Limit access to ICMP-related sysctl variables to prevent unauthorized modifications

chmod 600 /proc/sys/net/ipv4/icmp_*
sysctl -w kernel.sysctl_protected=1

Disable ICMP sysctl modifications

linux

Set ICMP sysctl variables to read-only or restrict modification capabilities

echo 'kernel.sysctl_protected = 1' >> /etc/sysctl.conf
sysctl -p

🧯 If You Can't Patch

Implement strict access controls to prevent unauthorized users from modifying sysctl variables
Monitor system logs for unusual ICMP-related sysctl modifications or kernel instability events

🔍 How to Verify

Check if Vulnerable:

Check kernel version and compare with patched versions in git commits: uname -r

Check Version:

uname -r

Verify Fix Applied:

Verify kernel version matches patched version and check that READ_ONCE() protections are in ICMP sysctl code

📡 Detection & Monitoring

Log Indicators:

Kernel panic logs
System instability reports
Unauthorized sysctl modification attempts in audit logs

Network Indicators:

Unusual ICMP behavior or rate changes

SIEM Query:

source="kernel" AND ("panic" OR "oops" OR "BUG") OR source="audit" AND "sysctl" AND "icmp"

📊 Metadata

CVE ID: CVE-2022-49638

CVSS v3 Score: 4.7 (MEDIUM)

CVSS Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE: CWE-362

EPSS Score: 0.03% exploit probability (7.2th percentile)

Published: February 26, 2025

Last Updated: October 1, 2025

📋 TL;DR

💻 Affected Systems

📦 What is this software?

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

⚠️ Risk & Real-World Impact

Worst Case

Likely Case

If Mitigated

🎯 Exploit Status

🛠️ Fix & Mitigation

✅ Official Fix

Instructions:

🔧 Temporary Workarounds

Restrict sysctl access

Disable ICMP sysctl modifications

🧯 If You Can't Patch

🔍 How to Verify

Check if Vulnerable:

Check Version:

Verify Fix Applied:

📡 Detection & Monitoring

Log Indicators:

Network Indicators:

SIEM Query:

📊 Metadata

🔗 References

📤 Share & Export

🔗 Related Vulnerabilities