{"vulnerability": "CVE-2022-48906", "sightings": [{"uuid": "7fdf206e-a6de-42b7-ac33-be4aae635ab6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2022-48906", "type": "seen", "source": "https://t.me/cvedetector/3872", "content": "{\n  \"Source\": \"CVE FEED\",\n  \"Title\": \"CVE-2022-48906 - Linux MPTCP Shift-OutOfBounds Vulnerability\", \n  \"Content\": \"CVE ID : CVE-2022-48906 \nPublished : Aug. 22, 2024, 2:15 a.m. | 37\u00a0minutes ago \nDescription : In the Linux kernel, the following vulnerability has been resolved:  \n  \nmptcp: Correctly set DATA_FIN timeout when number of retransmits is large  \n  \nSyzkaller with UBSAN uncovered a scenario where a large number of  \nDATA_FIN retransmits caused a shift-out-of-bounds in the DATA_FIN  \ntimeout calculation:  \n  \n================================================================================  \nUBSAN: shift-out-of-bounds in net/mptcp/protocol.c:470:29  \nshift exponent 32 is too large for 32-bit type 'unsigned int'  \nCPU: 1 PID: 13059 Comm: kworker/1:0 Not tainted 5.17.0-rc2-00630-g5fbf21c90c60 #1  \nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1ubuntu1.1 04/01/2014  \nWorkqueue: events mptcp_worker  \nCall Trace:  \n   \n __dump_stack lib/dump_stack.c:88 [inline]  \n dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106  \n ubsan_epilogue+0xb/0x5a lib/ubsan.c:151  \n __ubsan_handle_shift_out_of_bounds.cold+0xb2/0x20e lib/ubsan.c:330  \n mptcp_set_datafin_timeout net/mptcp/protocol.c:470 [inline]  \n __mptcp_retrans.cold+0x72/0x77 net/mptcp/protocol.c:2445  \n mptcp_worker+0x58a/0xa70 net/mptcp/protocol.c:2528  \n process_one_work+0x9df/0x16d0 kernel/workqueue.c:2307  \n worker_thread+0x95/0xe10 kernel/workqueue.c:2454  \n kthread+0x2f4/0x3b0 kernel/kthread.c:377  \n ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295  \n   \n================================================================================  \n  \nThis change limits the maximum timeout by limiting the size of the  \nshift, which keeps all intermediate values in-bounds. \nSeverity: 0.0 | NA \nVisit the link for more details, such as CVSS details, affected products, timeline, and more...\",\n  \"Detection Date\": \"22 Aug 2024\",\n  \"Type\": \"Vulnerability\"\n}\n\ud83d\udd39 t.me/cvedetector \ud83d\udd39", "creation_timestamp": "2024-08-22T05:08:53.000000Z"}]}