Vulnerability-Lookup

CVE-2022-49561 (GCVE-0-2022-49561)

Vulnerability from cvelistv5 – Published: 2025-02-26 02:14 – Updated: 2025-05-04 08:40

Title

netfilter: conntrack: re-fetch conntrack after insertion

Summary

In the Linux kernel, the following vulnerability has been resolved: netfilter: conntrack: re-fetch conntrack after insertion In case the conntrack is clashing, insertion can free skb->_nfct and set skb->_nfct to the already-confirmed entry. This wasn't found before because the conntrack entry and the extension space used to free'd after an rcu grace period, plus the race needs events enabled to trigger.

Severity ?

No CVSS data available.

Assigner

Linux

References

URL

Tags

	https://git.kernel.org/stable/c/e97222b785e70e897…
	https://git.kernel.org/stable/c/92a999d1963eed0df…
	https://git.kernel.org/stable/c/b16bb373988da3ceb…
	https://git.kernel.org/stable/c/91a36ec160ec1a0c8…
	https://git.kernel.org/stable/c/01989d7eebb61c99b…
	https://git.kernel.org/stable/c/04f9e9104c969d8ce…
	https://git.kernel.org/stable/c/04e4a11dc723c52db…
	https://git.kernel.org/stable/c/56b14ecec97f39118…

Impacted products

Vendor

Product

Version

Linux

Affected: 71d8c47fc653711c41bc3282e5b0e605b3727956 , < e97222b785e70e8973281666d709baad6523d8af (git)
Affected: 71d8c47fc653711c41bc3282e5b0e605b3727956 , < 92a999d1963eed0df666284e20055136ceabd12f (git)
Affected: 71d8c47fc653711c41bc3282e5b0e605b3727956 , < b16bb373988da3ceb0308381634117e18b6ec60d (git)
Affected: 71d8c47fc653711c41bc3282e5b0e605b3727956 , < 91a36ec160ec1a0c8f5352b772dffcbb0b6023e3 (git)
Affected: 71d8c47fc653711c41bc3282e5b0e605b3727956 , < 01989d7eebb61c99bd4b88ebc8e261bd2f02caed (git)
Affected: 71d8c47fc653711c41bc3282e5b0e605b3727956 , < 04f9e9104c969d8ce10a4a43634f641ed082092d (git)
Affected: 71d8c47fc653711c41bc3282e5b0e605b3727956 , < 04e4a11dc723c52db7a36dc58f0d69ce6426f8f0 (git)
Affected: 71d8c47fc653711c41bc3282e5b0e605b3727956 , < 56b14ecec97f39118bf85c9ac2438c5a949509ed (git)

Linux

Affected: 4.7
Unaffected: 0 , < 4.7 (semver)
Unaffected: 4.14.282 , ≤ 4.14.* (semver)
Unaffected: 4.19.246 , ≤ 4.19.* (semver)
Unaffected: 5.4.197 , ≤ 5.4.* (semver)
Unaffected: 5.10.120 , ≤ 5.10.* (semver)
Unaffected: 5.15.45 , ≤ 5.15.* (semver)
Unaffected: 5.17.13 , ≤ 5.17.* (semver)
Unaffected: 5.18.2 , ≤ 5.18.* (semver)
Unaffected: 5.19 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "include/net/netfilter/nf_conntrack_core.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "e97222b785e70e8973281666d709baad6523d8af",
              "status": "affected",
              "version": "71d8c47fc653711c41bc3282e5b0e605b3727956",
              "versionType": "git"
            },
            {
              "lessThan": "92a999d1963eed0df666284e20055136ceabd12f",
              "status": "affected",
              "version": "71d8c47fc653711c41bc3282e5b0e605b3727956",
              "versionType": "git"
            },
            {
              "lessThan": "b16bb373988da3ceb0308381634117e18b6ec60d",
              "status": "affected",
              "version": "71d8c47fc653711c41bc3282e5b0e605b3727956",
              "versionType": "git"
            },
            {
              "lessThan": "91a36ec160ec1a0c8f5352b772dffcbb0b6023e3",
              "status": "affected",
              "version": "71d8c47fc653711c41bc3282e5b0e605b3727956",
              "versionType": "git"
            },
            {
              "lessThan": "01989d7eebb61c99bd4b88ebc8e261bd2f02caed",
              "status": "affected",
              "version": "71d8c47fc653711c41bc3282e5b0e605b3727956",
              "versionType": "git"
            },
            {
              "lessThan": "04f9e9104c969d8ce10a4a43634f641ed082092d",
              "status": "affected",
              "version": "71d8c47fc653711c41bc3282e5b0e605b3727956",
              "versionType": "git"
            },
            {
              "lessThan": "04e4a11dc723c52db7a36dc58f0d69ce6426f8f0",
              "status": "affected",
              "version": "71d8c47fc653711c41bc3282e5b0e605b3727956",
              "versionType": "git"
            },
            {
              "lessThan": "56b14ecec97f39118bf85c9ac2438c5a949509ed",
              "status": "affected",
              "version": "71d8c47fc653711c41bc3282e5b0e605b3727956",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "include/net/netfilter/nf_conntrack_core.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.7"
            },
            {
              "lessThan": "4.7",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.14.*",
              "status": "unaffected",
              "version": "4.14.282",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.19.*",
              "status": "unaffected",
              "version": "4.19.246",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.197",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.120",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.45",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.17.*",
              "status": "unaffected",
              "version": "5.17.13",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.18.*",
              "status": "unaffected",
              "version": "5.18.2",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "5.19",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.14.282",
                  "versionStartIncluding": "4.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.19.246",
                  "versionStartIncluding": "4.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.197",
                  "versionStartIncluding": "4.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.120",
                  "versionStartIncluding": "4.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.45",
                  "versionStartIncluding": "4.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.17.13",
                  "versionStartIncluding": "4.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.18.2",
                  "versionStartIncluding": "4.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.19",
                  "versionStartIncluding": "4.7",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: conntrack: re-fetch conntrack after insertion\n\nIn case the conntrack is clashing, insertion can free skb-\u003e_nfct and\nset skb-\u003e_nfct to the already-confirmed entry.\n\nThis wasn\u0027t found before because the conntrack entry and the extension\nspace used to free\u0027d after an rcu grace period, plus the race needs\nevents enabled to trigger."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-05-04T08:40:35.483Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/e97222b785e70e8973281666d709baad6523d8af"
        },
        {
          "url": "https://git.kernel.org/stable/c/92a999d1963eed0df666284e20055136ceabd12f"
        },
        {
          "url": "https://git.kernel.org/stable/c/b16bb373988da3ceb0308381634117e18b6ec60d"
        },
        {
          "url": "https://git.kernel.org/stable/c/91a36ec160ec1a0c8f5352b772dffcbb0b6023e3"
        },
        {
          "url": "https://git.kernel.org/stable/c/01989d7eebb61c99bd4b88ebc8e261bd2f02caed"
        },
        {
          "url": "https://git.kernel.org/stable/c/04f9e9104c969d8ce10a4a43634f641ed082092d"
        },
        {
          "url": "https://git.kernel.org/stable/c/04e4a11dc723c52db7a36dc58f0d69ce6426f8f0"
        },
        {
          "url": "https://git.kernel.org/stable/c/56b14ecec97f39118bf85c9ac2438c5a949509ed"
        }
      ],
      "title": "netfilter: conntrack: re-fetch conntrack after insertion",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2022-49561",
    "datePublished": "2025-02-26T02:14:06.030Z",
    "dateReserved": "2025-02-26T02:08:31.591Z",
    "dateUpdated": "2025-05-04T08:40:35.483Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2022-49561\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-02-26T07:01:31.877\",\"lastModified\":\"2025-10-24T15:50:35.257\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnetfilter: conntrack: re-fetch conntrack after insertion\\n\\nIn case the conntrack is clashing, insertion can free skb-\u003e_nfct and\\nset skb-\u003e_nfct to the already-confirmed entry.\\n\\nThis wasn\u0027t found before because the conntrack entry and the extension\\nspace used to free\u0027d after an rcu grace period, plus the race needs\\nevents enabled to trigger.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: netfilter: conntrack: volver a obtener conntrack despu\u00e9s de la inserci\u00f3n En caso de que conntrack est\u00e9 en conflicto, la inserci\u00f3n puede liberar skb-\u0026gt;_nfct y establecer skb-\u0026gt;_nfct en la entrada ya confirmada. Esto no se encontr\u00f3 antes porque la entrada conntrack y el espacio de extensi\u00f3n sol\u00edan liberarse despu\u00e9s de un per\u00edodo de gracia de rcu, adem\u00e1s de que la ejecuci\u00f3n necesita eventos habilitados para activarse.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-noinfo\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.7\",\"versionEndExcluding\":\"4.14.282\",\"matchCriteriaId\":\"897D9E70-5BA4-4E88-B774-C6A3B6B853EF\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.15\",\"versionEndExcluding\":\"4.19.246\",\"matchCriteriaId\":\"FEDF30DC-BB12-4C4C-A134-AA5D59D73C0C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.20\",\"versionEndExcluding\":\"5.4.197\",\"matchCriteriaId\":\"F7FDD830-741D-44F7-A537-13755A4314DE\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.5\",\"versionEndExcluding\":\"5.10.120\",\"matchCriteriaId\":\"92818976-ECCC-4744-9287-E2CF4B2C4131\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.11\",\"versionEndExcluding\":\"5.15.45\",\"matchCriteriaId\":\"08D699AD-F4CE-4BDD-A97E-4997299C7712\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.16\",\"versionEndExcluding\":\"5.17.13\",\"matchCriteriaId\":\"192FC54B-5367-49D6-B410-0285F14665B1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.18\",\"versionEndExcluding\":\"5.18.2\",\"matchCriteriaId\":\"9FF255A1-64F4-4E31-AF44-C92FB8773BA2\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/01989d7eebb61c99bd4b88ebc8e261bd2f02caed\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/04e4a11dc723c52db7a36dc58f0d69ce6426f8f0\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/04f9e9104c969d8ce10a4a43634f641ed082092d\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/56b14ecec97f39118bf85c9ac2438c5a949509ed\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/91a36ec160ec1a0c8f5352b772dffcbb0b6023e3\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/92a999d1963eed0df666284e20055136ceabd12f\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/b16bb373988da3ceb0308381634117e18b6ec60d\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/e97222b785e70e8973281666d709baad6523d8af\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}"
  }
}

GHSA-MWJ5-HV79-WR7F

Vulnerability from github – Published: 2025-10-24 18:30 – Updated: 2025-10-24 18:30

Details

In the Linux kernel, the following vulnerability has been resolved:

netfilter: conntrack: re-fetch conntrack after insertion

In case the conntrack is clashing, insertion can free skb->_nfct and set skb->_nfct to the already-confirmed entry.

This wasn't found before because the conntrack entry and the extension space used to free'd after an rcu grace period, plus the race needs events enabled to trigger.

Severity ?

5.5 (Medium)


                  
                    CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2022-49561"
  ],
  "database_specific": {
    "cwe_ids": [],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-02-26T07:01:31Z",
    "severity": "MODERATE"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: conntrack: re-fetch conntrack after insertion\n\nIn case the conntrack is clashing, insertion can free skb-\u003e_nfct and\nset skb-\u003e_nfct to the already-confirmed entry.\n\nThis wasn\u0027t found before because the conntrack entry and the extension\nspace used to free\u0027d after an rcu grace period, plus the race needs\nevents enabled to trigger.",
  "id": "GHSA-mwj5-hv79-wr7f",
  "modified": "2025-10-24T18:30:56Z",
  "published": "2025-10-24T18:30:56Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-49561"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/01989d7eebb61c99bd4b88ebc8e261bd2f02caed"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/04e4a11dc723c52db7a36dc58f0d69ce6426f8f0"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/04f9e9104c969d8ce10a4a43634f641ed082092d"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/56b14ecec97f39118bf85c9ac2438c5a949509ed"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/91a36ec160ec1a0c8f5352b772dffcbb0b6023e3"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/92a999d1963eed0df666284e20055136ceabd12f"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/b16bb373988da3ceb0308381634117e18b6ec60d"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/e97222b785e70e8973281666d709baad6523d8af"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

FKIE_CVE-2022-49561

Vulnerability from fkie_nvd - Published: 2025-02-26 07:01 - Updated: 2025-10-24 15:50

Severity ?

5.5 (Medium) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Summary

References

URL	Tags
416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/01989d7eebb61c99bd4b88ebc8e261bd2f02caed	Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/04e4a11dc723c52db7a36dc58f0d69ce6426f8f0	Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/04f9e9104c969d8ce10a4a43634f641ed082092d	Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/56b14ecec97f39118bf85c9ac2438c5a949509ed	Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/91a36ec160ec1a0c8f5352b772dffcbb0b6023e3	Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/92a999d1963eed0df666284e20055136ceabd12f	Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/b16bb373988da3ceb0308381634117e18b6ec60d	Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/e97222b785e70e8973281666d709baad6523d8af	Patch

Impacted products

Vendor	Product	Version
linux	linux_kernel	*
linux	linux_kernel	*
linux	linux_kernel	*
linux	linux_kernel	*
linux	linux_kernel	*
linux	linux_kernel	*
linux	linux_kernel	*

JSON

To clipboard

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "897D9E70-5BA4-4E88-B774-C6A3B6B853EF",
              "versionEndExcluding": "4.14.282",
              "versionStartIncluding": "4.7",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "FEDF30DC-BB12-4C4C-A134-AA5D59D73C0C",
              "versionEndExcluding": "4.19.246",
              "versionStartIncluding": "4.15",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "F7FDD830-741D-44F7-A537-13755A4314DE",
              "versionEndExcluding": "5.4.197",
              "versionStartIncluding": "4.20",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "92818976-ECCC-4744-9287-E2CF4B2C4131",
              "versionEndExcluding": "5.10.120",
              "versionStartIncluding": "5.5",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "08D699AD-F4CE-4BDD-A97E-4997299C7712",
              "versionEndExcluding": "5.15.45",
              "versionStartIncluding": "5.11",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "192FC54B-5367-49D6-B410-0285F14665B1",
              "versionEndExcluding": "5.17.13",
              "versionStartIncluding": "5.16",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "9FF255A1-64F4-4E31-AF44-C92FB8773BA2",
              "versionEndExcluding": "5.18.2",
              "versionStartIncluding": "5.18",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: conntrack: re-fetch conntrack after insertion\n\nIn case the conntrack is clashing, insertion can free skb-\u003e_nfct and\nset skb-\u003e_nfct to the already-confirmed entry.\n\nThis wasn\u0027t found before because the conntrack entry and the extension\nspace used to free\u0027d after an rcu grace period, plus the race needs\nevents enabled to trigger."
    },
    {
      "lang": "es",
      "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: netfilter: conntrack: volver a obtener conntrack despu\u00e9s de la inserci\u00f3n En caso de que conntrack est\u00e9 en conflicto, la inserci\u00f3n puede liberar skb-\u0026gt;_nfct y establecer skb-\u0026gt;_nfct en la entrada ya confirmada. Esto no se encontr\u00f3 antes porque la entrada conntrack y el espacio de extensi\u00f3n sol\u00edan liberarse despu\u00e9s de un per\u00edodo de gracia de rcu, adem\u00e1s de que la ejecuci\u00f3n necesita eventos habilitados para activarse."
    }
  ],
  "id": "CVE-2022-49561",
  "lastModified": "2025-10-24T15:50:35.257",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "LOCAL",
          "availabilityImpact": "HIGH",
          "baseScore": 5.5,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 3.6,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2025-02-26T07:01:31.877",
  "references": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/01989d7eebb61c99bd4b88ebc8e261bd2f02caed"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/04e4a11dc723c52db7a36dc58f0d69ce6426f8f0"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/04f9e9104c969d8ce10a4a43634f641ed082092d"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/56b14ecec97f39118bf85c9ac2438c5a949509ed"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/91a36ec160ec1a0c8f5352b772dffcbb0b6023e3"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/92a999d1963eed0df666284e20055136ceabd12f"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/b16bb373988da3ceb0308381634117e18b6ec60d"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/e97222b785e70e8973281666d709baad6523d8af"
    }
  ],
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-noinfo"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

SUSE-SU-2025:01600-1

Vulnerability from csaf_suse - Published: 2025-05-20 11:49 - Updated: 2025-05-20 11:49

Summary

Security update for the Linux Kernel

Severity

Important

Notes

Title of the patch: Security update for the Linux Kernel

Description of the patch: The SUSE Linux Enterprise 12 SP5 kernel was updated to receive various security bugfixes. The following security bugs were fixed: - CVE-2021-47659: drm/plane: Move range check for format_count earlier (bsc#1237839). - CVE-2022-49044: dm integrity: fix memory corruption when tag_size is less than digest size (bsc#1237840). - CVE-2022-49055: drm/amdkfd: Check for potential null return of kmalloc_array() (bsc#1237868). - CVE-2022-49060: net/smc: Fix NULL pointer dereference in smc_pnet_find_ib() (bsc#1237845). - CVE-2022-49086: net: openvswitch: fix leak of nested actions (bsc#1238037). - CVE-2022-49111: Bluetooth: Fix use after free in hci_send_acl (bsc#1237984). - CVE-2022-49118: scsi: hisi_sas: Free irq vectors in order for v3 HW (bsc#1237979). - CVE-2022-49121: scsi: pm8001: Fix tag leaks on error (bsc#1237926). - CVE-2022-49137: drm/amd/amdgpu/amdgpu_cs: fix refcount leak of a dma_fence obj (bsc#1238155). - CVE-2022-49175: PM: core: keep irq flags in device_pm_check_callbacks() (bsc#1238099). - CVE-2022-49176: bfq: fix use-after-free in bfq_dispatch_request (bsc#1238097). - CVE-2022-49179: block, bfq: do not move oom_bfqq (bsc#1238092). - CVE-2022-49188: remoteproc: qcom_q6v5_mss: Fix some leaks in q6v5_alloc_memory_region (bsc#1238138). - CVE-2022-49197: af_netlink: Fix shift out of bounds in group mask calculation (bsc#1238455). - CVE-2022-49205: bpf, sockmap: Fix double uncharge the mem of sk_msg (bsc#1238335). - CVE-2022-49232: drm/amd/display: Fix a NULL pointer dereference in amdgpu_dm_connector_add_common_modes() (bsc#1238139). - CVE-2022-49290: mac80211: fix potential double free on mesh join (bsc#1238156). - CVE-2022-49305: drivers: staging: rtl8192u: Fix deadlock in ieee80211_beacons_stop() (bsc#1238645). - CVE-2022-49325: tcp: add accessors to read/set tp->snd_cwnd (bsc#1238398). - CVE-2022-49335: drm/amdgpu/cs: make commands with 0 chunks illegal behaviour (bsc#1238377). - CVE-2022-49351: net: altera: Fix refcount leak in altera_tse_mdio_create (bsc#1237939). - CVE-2022-49385: driver: base: fix UAF when driver_attach failed (bsc#1237951). - CVE-2022-49390: macsec: fix UAF bug for real_dev (bsc#1238233). - CVE-2022-49411: bfq: Make sure bfqg for which we are queueing requests is online (bsc#1238307). - CVE-2022-49442: drivers/base/node.c: fix compaction sysfs file leak (bsc#1238243). - CVE-2022-49465: blk-throttle: Set BIO_THROTTLED when bio has been throttled (bsc#1238919). - CVE-2022-49478: media: pvrusb2: fix array-index-out-of-bounds in pvr2_i2c_core_init (bsc#1238000). - CVE-2022-49489: drm/msm/disp/dpu1: set vbif hw config to NULL to avoid use after memory free during pm runtime resume (bsc#1238244). - CVE-2022-49504: scsi: lpfc: Inhibit aborts if external loopback plug is inserted (bsc#1238835). - CVE-2022-49521: scsi: lpfc: Fix resource leak in lpfc_sli4_send_seq_to_ulp() (bsc#1238938). - CVE-2022-49525: media: cx25821: Fix the warning when removing the module (bsc#1238022). - CVE-2022-49534: scsi: lpfc: Protect memory leak for NPIV ports sending PLOGI_RJT (bsc#1238893). - CVE-2022-49535: scsi: lpfc: Fix null pointer dereference after failing to issue FLOGI and PLOGI (bsc#1238937). - CVE-2022-49536: scsi: lpfc: Fix SCSI I/O completion and abort handler deadlock (bsc#1238838). - CVE-2022-49537: scsi: lpfc: Fix call trace observed during I/O with CMF enabled (bsc#1238930). - CVE-2022-49542: scsi: lpfc: Move cfg_log_verbose check before calling lpfc_dmp_dbg() (bsc#1238722). - CVE-2022-49561: netfilter: conntrack: re-fetch conntrack after insertion (bsc#1238537). - CVE-2022-49590: igmp: Fix data-races around sysctl_igmp_llm_reports (bsc#1238844). - CVE-2022-49658: bpf, selftests: Add verifier test case for imm=0,umin=0,umax=1 scalar (bsc#1238803). - CVE-2022-49668: PM / devfreq: exynos-ppmu: Fix refcount leak in of_get_devfreq_events (bsc#1237957). - CVE-2022-49693: drm/msm/mdp4: Fix refcount leak in mdp4_modeset_init_intf (bsc#1237954). - CVE-2022-49725: i40e: Fix call trace in setup_tx_descriptors (bsc#1238016). - CVE-2022-49728: kABI workaround for changeing the variable length type to size_t (bsc#1239111). - CVE-2022-49730: scsi: lpfc: Resolve NULL ptr dereference after an ELS LOGO is aborted (bsc#1239070). - CVE-2022-49749: i2c: designware: use casting of u64 in clock multiplication to avoid overflow (bsc#1240243). - CVE-2022-49753: dmaengine: Fix double increment of client_count in dma_chan_get() (bsc#1240250). - CVE-2023-53023: net: nfc: Fix use-after-free in local_cleanup() (bsc#1240309). - CVE-2023-53032: netfilter: ipset: Fix overflow before widen in the bitmap_ip_create() function (bsc#1240270). - CVE-2024-49994: block: fix integer overflow in BLKSECDISCARD (bsc#1237757). - CVE-2024-50038: netfilter: xtables: fix typo causing some targets not to load on IPv6 (bsc#1231910). - CVE-2024-50272: filemap: Fix bounds checking in filemap_read() (bsc#1233461 bsc#1234209). - CVE-2024-52559: drm/msm/gem: prevent integer overflow in msm_ioctl_gem_submit() (bsc#1238507). - CVE-2024-54683: netfilter: IDLETIMER: Fix for possible ABBA deadlock (bsc#1235729). - CVE-2024-56590: skbuff: introduce skb_pull_data (bsc#1235038). - CVE-2024-56641: net/smc: initialize close_work early to avoid warning (bsc#1235526). - CVE-2024-57924: fs: relax assertions on failure to encode file handles (bsc#1236086). - CVE-2024-57980: media: uvcvideo: Fix double free in error path (bsc#1237911). - CVE-2024-57981: usb: xhci: Fix NULL pointer dereference on certain command aborts (bsc#1237912). - CVE-2024-58005: tpm: Change to kvalloc() in eventlog/acpi.c (bsc#1237873). - CVE-2024-58009: Bluetooth: L2CAP: handle NULL sock pointer in l2cap_sock_alloc (bsc#1238760). - CVE-2024-58017: printk: Fix signed integer overflow when defining LOG_BUF_LEN_MAX (bsc#1237950 bsc#1239112). - CVE-2024-58063: wifi: rtlwifi: fix memory leaks and invalid access at probe error path (bsc#1238984). - CVE-2024-58093: PCI/ASPM: Fix link state exit during switch upstream function removal (bsc#1241347). - CVE-2025-21635: rds: sysctl: rds_tcp_{rcv,snd}buf: avoid using current->nsproxy (bsc#1236111). - CVE-2025-21735: NFC: nci: Add bounds checking in nci_hci_create_pipe() (bsc#1238497). - CVE-2025-21750: wifi: brcmfmac: Check the return value of of_property_read_string_index() (bsc#1238905). - CVE-2025-21758: ipv6: mcast: add RCU protection to mld_newpack() (bsc#1238737). - CVE-2025-21768: net: ipv6: fix dst ref loops in rpl, seg6 and ioam6 lwtunnels (bsc#1238714). - CVE-2025-21772: partitions: mac: fix handling of bogus partition table (bsc#1238911). - CVE-2025-21779: KVM: x86: Reject Hyper-V's SEND_IPI hypercalls if local APIC isn't in-kernel (bsc#1238768). - CVE-2025-21806: net: let net.core.dev_weight always be non-zero (bsc#1238746). - CVE-2025-21862: drop_monitor: fix incorrect initialization order (bsc#1239474). - CVE-2025-21881: uprobes: Reject the shared zeropage in uprobe_write_opcode() (bsc#1240185). - CVE-2025-21909: wifi: nl80211: reject cooked mode if it is set along with other flags (bsc#1240590). - CVE-2025-21910: wifi: cfg80211: regulatory: improve invalid hints checking (bsc#1240583). - CVE-2025-21926: net: gso: fix ownership in __udp_gso_segment (bsc#1240712). - CVE-2025-21927: nvme-tcp: fix potential memory corruption in nvme_tcp_recv_pdu() (bsc#1240714). - CVE-2025-21931: hwpoison, memory_hotplug: lock folio before unmap hwpoisoned folio (bsc#1240709). - CVE-2025-21941: drm/amd/display: Fix null check for pipe_ctx->plane_state in (bsc#1240701). - CVE-2025-21948: HID: appleir: Fix potential NULL dereference at raw event handle (bsc#1240703). - CVE-2025-21956: drm/amd/display: Assign normalized_pix_clk when color depth = 14 (bsc#1240739). - CVE-2025-21957: scsi: qla1280: Fix kernel oops when debug level > 2 (bsc#1240742). - CVE-2025-21963: cifs: Fix integer overflow while processing acdirmax mount option (bsc#1240717). - CVE-2025-21964: cifs: Fix integer overflow while processing acregmax mount option (bsc#1240740). - CVE-2025-21976: fbdev: hyperv_fb: Allow graceful removal of framebuffer (bsc#1241145). - CVE-2025-22004: net: atm: fix use after free in lec_send() (bsc#1240835). - CVE-2025-22008: regulator: check that dummy regulator has been probed before using it (bsc#1240942). - CVE-2025-22010: RDMA/hns: Fix soft lockup during bt pages loop (bsc#1240943). - CVE-2025-22018: atm: Fix NULL pointer dereference (bsc#1241266). - CVE-2025-22053: net: ibmveth: make veth_pool_store stop hanging (bsc#1241373). - CVE-2025-22055: net: fix geneve_opt length integer overflow (bsc#1241371). - CVE-2025-22060: net: mvpp2: Prevent parser TCAM memory corruption (bsc#1241526). - CVE-2025-22086: RDMA/mlx5: Fix mlx5_poll_one() cur_qp update flow (bsc#1241458). - CVE-2025-23131: dlm: prevent NPD when writing a positive value to event_done (bsc#1241601). - CVE-2025-37785: ext4: fix OOB read when checking dotdot dir (bsc#1241640). The following non-security bugs were fixed: - Revert 'ipv6: Fix signed integer overflow in __ip6_append_data' - Revert 'kABI workaround for changeing the variable length type to size_t' - audit: Send netlink ACK before setting connection in auditd_set (bsc#1231450). - brcmfmac: of: Use devm_kstrdup for board_type & check for errors (bsc#1238905) - brcmfmac: of: remove redundant variable len (bsc#1238905) - cifs: Fix integer overflow while processing actimeo mount option (git-fixes). - fbdev: hyperv_fb: Simplify hvfb_putmem (git-fixes). - net: Fix data-races around weight_p and dev_weight_[rt]x_bias (bsc#1238746) - remoteproc: qcom_q6v5_mss: Extract mba/mpss from memory-region (bsc#1238138) - tpm, tpm_tis: Workaround failed command reception on Infineon devices (bsc#1235870). - tpm: tis: Double the timeout B to 4s (bsc#1235870). - wifi: brcmfmac: use strreplace() in brcmf_of_probe() (bsc#1238905) - x86/bhi: Do not set BHI_DIS_S in 32-bit mode (bsc#1242778). - x86/bpf: Add IBHF call at end of classic BPF (bsc#1242778). - x86/bpf: Call branch history clearing sequence on exit (bsc#1242778).

Patchnames: SUSE-2025-1600,SUSE-SLE-Live-Patching-12-SP5-2025-1600,SUSE-SLE-SERVER-12-SP5-LTSS-2025-1600,SUSE-SLE-SERVER-12-SP5-LTSS-EXTENDED-SECURITY-2025-1600

CVE-2020-36789

5.5 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H