Memory Access Vulnerability in Linux Kernel: CVE-2022-48673
Summary
CVE-2022-48673: In the Linux kernel, the following vulnerability has been resolved: net/smc: Fix possible access to freed memory in link clear After modifying the QP to the Error state, all RX WR would be completed with WC in IB_WC_WR_F... Affects linux versions 5.10.103-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of many operating systems, providing essential services for hardware and software interaction. It is known for its stability, performance, and security features. However, vulnerabilities can arise, such as CVE-2022-48673, which affects the kernel's networking subsystem, specifically the SMC (Shared Memory Communication) protocol. This vulnerability can lead to potential memory access issues, impacting system reliability.
Vulnerability Detail
CVE-2022-48673 is a vulnerability in the Linux kernel's networking subsystem that allows for possible access to freed memory in tasklet context. This occurs when a Queue Pair (QP) is modified to the Error state, leading to all RX Work Requests (WR) being completed with a status of IB_WC_WR_FLUSH_ERR. The current implementation does not wait for the completion of these requests before destroying the QP and freeing the associated link group, creating a risk of accessing freed memory. This can result in system crashes and instability, as evidenced by the provided crash example.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can avoid using the SMC protocol until the kernel is updated. This may involve reconfiguring applications that rely on this protocol to use alternative communication methods.
Conclusion
CVE-2022-48673 is a significant vulnerability in the Linux kernel that can lead to serious memory access issues. It is crucial for users to update their systems to the latest kernel version to protect against potential crashes and instability. Utilizing tools like Vulert can help monitor for such vulnerabilities in real-time.
See every vulnerability recorded for linux →
FAQ
CVE-2022-48673 is a vulnerability in the Linux kernel that can lead to memory access issues due to improper handling of network requests.
This vulnerability can cause system crashes and instability by allowing access to freed memory, potentially leading to data corruption or loss.
You should update your Linux kernel to version 5.19.11-1 or later to mitigate the vulnerability.
Yes, you can use Vulert, which allows you to monitor and alert for open-source vulnerabilities in your software using just a manifest file. You can check your application against this vulnerability using the Vulert playground without any signup.
The CVSS score for CVE-2022-48673 is 5.5, indicating a moderate level of severity.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
