CVE-2022-49017 (GCVE-0-2022-49017)

Vulnerability from cvelistv5 – Published: 2024-10-21 20:06 – Updated: 2026-08-05 08:53
VLAI
Title
tipc: re-fetch skb cb after tipc_msg_validate
Summary
In the Linux kernel, the following vulnerability has been resolved: tipc: re-fetch skb cb after tipc_msg_validate As the call trace shows, the original skb was freed in tipc_msg_validate(), and dereferencing the old skb cb would cause an use-after-free crash. BUG: KASAN: use-after-free in tipc_crypto_rcv_complete+0x1835/0x2240 [tipc] Call Trace: <IRQ> tipc_crypto_rcv_complete+0x1835/0x2240 [tipc] tipc_crypto_rcv+0xd32/0x1ec0 [tipc] tipc_rcv+0x744/0x1150 [tipc] ... Allocated by task 47078: kmem_cache_alloc_node+0x158/0x4d0 __alloc_skb+0x1c1/0x270 tipc_buf_acquire+0x1e/0xe0 [tipc] tipc_msg_create+0x33/0x1c0 [tipc] tipc_link_build_proto_msg+0x38a/0x2100 [tipc] tipc_link_timeout+0x8b8/0xef0 [tipc] tipc_node_timeout+0x2a1/0x960 [tipc] call_timer_fn+0x2d/0x1c0 ... Freed by task 47078: tipc_msg_validate+0x7b/0x440 [tipc] tipc_crypto_rcv_complete+0x4b5/0x2240 [tipc] tipc_crypto_rcv+0xd32/0x1ec0 [tipc] tipc_rcv+0x744/0x1150 [tipc] This patch fixes it by re-fetching the skb cb from the new allocated skb after calling tipc_msg_validate().
Severity
8.8 (High)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-10-22 13:13 UTC
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: fc1b6d6de2208774efd2a20bf0daddb02d18b1e0 , < a1ba595e35aa3afbe417ff0af353afb9f65559c0 (git)
Affected: fc1b6d6de2208774efd2a20bf0daddb02d18b1e0 , < 1daec0815655e110c6f206c5e777a4af8168ff58 (git)
Affected: fc1b6d6de2208774efd2a20bf0daddb02d18b1e0 , < e128190adb2edfd5042105b5d1ed4553f295f5ef (git)
Affected: fc1b6d6de2208774efd2a20bf0daddb02d18b1e0 , < 3067bc61fcfe3081bf4807ce65560f499e895e77 (git)
guessed Create a notification for this product.
Linux Linux Affected: 5.5
Unaffected: 0 , < 5.5 (semver)
Unaffected: 5.10.158 , ≤ 5.10.* (semver)
Unaffected: 5.15.82 , ≤ 5.15.* (semver)
Unaffected: 6.0.12 , ≤ 6.0.* (semver)
Unaffected: 6.1 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2022-49017",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-10-22T13:13:05.882492Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-10-22T13:18:37.715Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/tipc/crypto.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "a1ba595e35aa3afbe417ff0af353afb9f65559c0",
              "status": "affected",
              "version": "fc1b6d6de2208774efd2a20bf0daddb02d18b1e0",
              "versionType": "git"
            },
            {
              "lessThan": "1daec0815655e110c6f206c5e777a4af8168ff58",
              "status": "affected",
              "version": "fc1b6d6de2208774efd2a20bf0daddb02d18b1e0",
              "versionType": "git"
            },
            {
              "lessThan": "e128190adb2edfd5042105b5d1ed4553f295f5ef",
              "status": "affected",
              "version": "fc1b6d6de2208774efd2a20bf0daddb02d18b1e0",
              "versionType": "git"
            },
            {
              "lessThan": "3067bc61fcfe3081bf4807ce65560f499e895e77",
              "status": "affected",
              "version": "fc1b6d6de2208774efd2a20bf0daddb02d18b1e0",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/tipc/crypto.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.5"
            },
            {
              "lessThan": "5.5",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.158",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.82",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.0.*",
              "status": "unaffected",
              "version": "6.0.12",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.158",
                  "versionStartIncluding": "5.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.82",
                  "versionStartIncluding": "5.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.0.12",
                  "versionStartIncluding": "5.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1",
                  "versionStartIncluding": "5.5",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntipc: re-fetch skb cb after tipc_msg_validate\n\nAs the call trace shows, the original skb was freed in tipc_msg_validate(),\nand dereferencing the old skb cb would cause an use-after-free crash.\n\n  BUG: KASAN: use-after-free in tipc_crypto_rcv_complete+0x1835/0x2240 [tipc]\n  Call Trace:\n   \u003cIRQ\u003e\n   tipc_crypto_rcv_complete+0x1835/0x2240 [tipc]\n   tipc_crypto_rcv+0xd32/0x1ec0 [tipc]\n   tipc_rcv+0x744/0x1150 [tipc]\n  ...\n  Allocated by task 47078:\n   kmem_cache_alloc_node+0x158/0x4d0\n   __alloc_skb+0x1c1/0x270\n   tipc_buf_acquire+0x1e/0xe0 [tipc]\n   tipc_msg_create+0x33/0x1c0 [tipc]\n   tipc_link_build_proto_msg+0x38a/0x2100 [tipc]\n   tipc_link_timeout+0x8b8/0xef0 [tipc]\n   tipc_node_timeout+0x2a1/0x960 [tipc]\n   call_timer_fn+0x2d/0x1c0\n  ...\n  Freed by task 47078:\n   tipc_msg_validate+0x7b/0x440 [tipc]\n   tipc_crypto_rcv_complete+0x4b5/0x2240 [tipc]\n   tipc_crypto_rcv+0xd32/0x1ec0 [tipc]\n   tipc_rcv+0x744/0x1150 [tipc]\n\nThis patch fixes it by re-fetching the skb cb from the new allocated skb\nafter calling tipc_msg_validate()."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The vulnerable path is tipc_udp_recv/tipc_l2_rcv_msg \u2192 tipc_rcv \u2192 tipc_crypto_rcv \u2192 tipc_crypto_rcv_complete, reached by processing encrypted TIPC packets from a remote peer over UDP or Ethernet bearers.\nAC:L - A peer who can send valid encrypted TIPC messages reliably drives the decrypt-complete path; the tipc_msg_validate skb replacement triggers on common high-truesize RX buffers (e.g. page-backed skbs), with no race beyond attacker control.\nPR:L - Successful AEAD decryption is required before tipc_msg_validate and the UAF write, so the attacker must possess the cluster/node TIPC encryption key as an authenticated peer, but needs no elevated OS privileges on the victim.\nUI:N - Exploitation is fully driven by attacker-sent encrypted packets; no victim user action is required once a TIPC bearer with crypto is configured and running.\nS:U - This is standard in-kernel memory corruption within the host TIPC stack and does not cross a VM, IOMMU, or other security authority boundary.\nC:H - Use-after-free of the skb control block enables heap reuse and attacker-controlled object contents, which can be leveraged for arbitrary kernel memory disclosure.\nI:H - The bug writes to freed skb-\u003ecb (decrypted flag and possibly tx_clone_ctx memset), giving a UAF write primitive exploitable for corruption and control-flow hijacking.\nA:H - The KASAN report shows a use-after-free crash in IRQ context; the UAF can cause kernel oops/panic and denial of service even when not fully exploited for code execution."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T08:53:28.139Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/a1ba595e35aa3afbe417ff0af353afb9f65559c0"
        },
        {
          "url": "https://git.kernel.org/stable/c/1daec0815655e110c6f206c5e777a4af8168ff58"
        },
        {
          "url": "https://git.kernel.org/stable/c/e128190adb2edfd5042105b5d1ed4553f295f5ef"
        },
        {
          "url": "https://git.kernel.org/stable/c/3067bc61fcfe3081bf4807ce65560f499e895e77"
        }
      ],
      "title": "tipc: re-fetch skb cb after tipc_msg_validate",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2022-49017",
    "datePublished": "2024-10-21T20:06:25.971Z",
    "dateReserved": "2024-08-22T01:27:53.646Z",
    "dateUpdated": "2026-08-05T08:53:28.139Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2022-49017",
      "date": "2026-09-24",
      "epss": "0.00642",
      "percentile": "0.48485"
    },
    "fkie_nvd": {
      "configurations": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "matchCriteriaId": "D0FB1AF1-0A0B-4419-B25F-C61F17380E18",
                  "versionEndExcluding": "5.10.158",
                  "versionStartIncluding": "5.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "matchCriteriaId": "0DC20DB6-73C1-4465-B931-117BFB8EBB02",
                  "versionEndExcluding": "5.15.82",
                  "versionStartIncluding": "5.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "matchCriteriaId": "D6D56E90-F3EE-413D-B3E2-B518932F0C7D",
                  "versionEndExcluding": "6.0.12",
                  "versionStartIncluding": "5.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:6.1:rc1:*:*:*:*:*:*",
                  "matchCriteriaId": "E7E331DA-1FB0-4DEC-91AC-7DA69D461C11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:6.1:rc2:*:*:*:*:*:*",
                  "matchCriteriaId": "17F0B248-42CF-4AE6-A469-BB1BAE7F4705",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:6.1:rc3:*:*:*:*:*:*",
                  "matchCriteriaId": "E2422816-0C14-4B5E-A1E6-A9D776E5C49B",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:6.1:rc4:*:*:*:*:*:*",
                  "matchCriteriaId": "1C6E00FE-5FB9-4D20-A1A1-5A32128F9B76",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:6.1:rc5:*:*:*:*:*:*",
                  "matchCriteriaId": "35B26BE4-43A6-4A36-A7F6-5B3F572D9186",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:6.1:rc6:*:*:*:*:*:*",
                  "matchCriteriaId": "3FFFB0B3-930D-408A-91E2-BAE0C2715D80",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:6.1:rc7:*:*:*:*:*:*",
                  "matchCriteriaId": "8535320E-A0DB-4277-800E-D0CE5BBA59E8",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntipc: re-fetch skb cb after tipc_msg_validate\n\nAs the call trace shows, the original skb was freed in tipc_msg_validate(),\nand dereferencing the old skb cb would cause an use-after-free crash.\n\n  BUG: KASAN: use-after-free in tipc_crypto_rcv_complete+0x1835/0x2240 [tipc]\n  Call Trace:\n   \u003cIRQ\u003e\n   tipc_crypto_rcv_complete+0x1835/0x2240 [tipc]\n   tipc_crypto_rcv+0xd32/0x1ec0 [tipc]\n   tipc_rcv+0x744/0x1150 [tipc]\n  ...\n  Allocated by task 47078:\n   kmem_cache_alloc_node+0x158/0x4d0\n   __alloc_skb+0x1c1/0x270\n   tipc_buf_acquire+0x1e/0xe0 [tipc]\n   tipc_msg_create+0x33/0x1c0 [tipc]\n   tipc_link_build_proto_msg+0x38a/0x2100 [tipc]\n   tipc_link_timeout+0x8b8/0xef0 [tipc]\n   tipc_node_timeout+0x2a1/0x960 [tipc]\n   call_timer_fn+0x2d/0x1c0\n  ...\n  Freed by task 47078:\n   tipc_msg_validate+0x7b/0x440 [tipc]\n   tipc_crypto_rcv_complete+0x4b5/0x2240 [tipc]\n   tipc_crypto_rcv+0xd32/0x1ec0 [tipc]\n   tipc_rcv+0x744/0x1150 [tipc]\n\nThis patch fixes it by re-fetching the skb cb from the new allocated skb\nafter calling tipc_msg_validate()."
        },
        {
          "lang": "es",
          "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: tipc: volver a obtener el skb cb despu\u00e9s de tipc_msg_validate Como muestra el seguimiento de la llamada, el skb original se liber\u00f3 en tipc_msg_validate(), y desreferenciar el antiguo skb cb causar\u00eda un bloqueo por use after free. ERROR: KASAN: use after free en tipc_crypto_rcv_complete+0x1835/0x2240 [tipc] Seguimiento de llamadas:  tipc_crypto_rcv_complete+0x1835/0x2240 [tipc] tipc_crypto_rcv+0xd32/0x1ec0 [tipc] tipc_rcv+0x744/0x1150 [tipc] ... Asignado por la tarea 47078: kmem_cache_alloc_node+0x158/0x4d0 __alloc_skb+0x1c1/0x270 tipc_buf_acquire+0x1e/0xe0 [tipc] tipc_msg_create+0x33/0x1c0 [tipc] tipc_link_build_proto_msg+0x38a/0x2100 [tipc] tipc_link_timeout+0x8b8/0xef0 [tipc] tipc_node_timeout+0x2a1/0x960 [tipc] call_timer_fn+0x2d/0x1c0 ... Liberado por la tarea 47078: tipc_msg_validate+0x7b/0x440 [tipc] tipc_crypto_rcv_complete+0x4b5/0x2240 [tipc] tipc_crypto_rcv+0xd32/0x1ec0 [tipc] tipc_rcv+0x744/0x1150 [tipc] Este parche lo corrige volviendo a obtener el cb skb del nuevo skb asignado despu\u00e9s de llamar a tipc_msg_validate()."
        }
      ],
      "id": "CVE-2022-49017",
      "lastModified": "2024-10-24T18:36:13.233",
      "metrics": {
        "cvssMetricV31": [
          {
            "cvssData": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 7.8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            },
            "exploitabilityScore": 1.8,
            "impactScore": 5.9,
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      },
      "published": "2024-10-21T20:15:12.910",
      "references": [
        {
          "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
          "tags": [
            "Patch"
          ],
          "url": "https://git.kernel.org/stable/c/1daec0815655e110c6f206c5e777a4af8168ff58"
        },
        {
          "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
          "tags": [
            "Patch"
          ],
          "url": "https://git.kernel.org/stable/c/3067bc61fcfe3081bf4807ce65560f499e895e77"
        },
        {
          "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
          "tags": [
            "Patch"
          ],
          "url": "https://git.kernel.org/stable/c/a1ba595e35aa3afbe417ff0af353afb9f65559c0"
        },
        {
          "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
          "tags": [
            "Patch"
          ],
          "url": "https://git.kernel.org/stable/c/e128190adb2edfd5042105b5d1ed4553f295f5ef"
        }
      ],
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Analyzed",
      "weaknesses": [
        {
          "description": [
            {
              "lang": "en",
              "value": "CWE-416"
            }
          ],
          "source": "nvd@nist.gov",
          "type": "Primary"
        }
      ]
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "net/tipc/crypto.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "a1ba595e35aa3afbe417ff0af353afb9f65559c0",
                    "status": "affected",
                    "version": "fc1b6d6de2208774efd2a20bf0daddb02d18b1e0",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "1daec0815655e110c6f206c5e777a4af8168ff58",
                    "status": "affected",
                    "version": "fc1b6d6de2208774efd2a20bf0daddb02d18b1e0",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "e128190adb2edfd5042105b5d1ed4553f295f5ef",
                    "status": "affected",
                    "version": "fc1b6d6de2208774efd2a20bf0daddb02d18b1e0",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "3067bc61fcfe3081bf4807ce65560f499e895e77",
                    "status": "affected",
                    "version": "fc1b6d6de2208774efd2a20bf0daddb02d18b1e0",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "net/tipc/crypto.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "5.5"
                  },
                  {
                    "lessThan": "5.5",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.10.*",
                    "status": "unaffected",
                    "version": "5.10.158",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.15.*",
                    "status": "unaffected",
                    "version": "5.15.82",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.0.*",
                    "status": "unaffected",
                    "version": "6.0.12",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "6.1",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "D0FB1AF1-0A0B-4419-B25F-C61F17380E18",
                    "versionEndExcluding": "5.10.158",
                    "versionStartIncluding": "5.5",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "0DC20DB6-73C1-4465-B931-117BFB8EBB02",
                    "versionEndExcluding": "5.15.82",
                    "versionStartIncluding": "5.11",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "D6D56E90-F3EE-413D-B3E2-B518932F0C7D",
                    "versionEndExcluding": "6.0.12",
                    "versionStartIncluding": "5.16",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.1:rc1:*:*:*:*:*:*",
                    "matchCriteriaId": "E7E331DA-1FB0-4DEC-91AC-7DA69D461C11",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.1:rc2:*:*:*:*:*:*",
                    "matchCriteriaId": "17F0B248-42CF-4AE6-A469-BB1BAE7F4705",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.1:rc3:*:*:*:*:*:*",
                    "matchCriteriaId": "E2422816-0C14-4B5E-A1E6-A9D776E5C49B",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.1:rc4:*:*:*:*:*:*",
                    "matchCriteriaId": "1C6E00FE-5FB9-4D20-A1A1-5A32128F9B76",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.1:rc5:*:*:*:*:*:*",
                    "matchCriteriaId": "35B26BE4-43A6-4A36-A7F6-5B3F572D9186",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.1:rc6:*:*:*:*:*:*",
                    "matchCriteriaId": "3FFFB0B3-930D-408A-91E2-BAE0C2715D80",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.1:rc7:*:*:*:*:*:*",
                    "matchCriteriaId": "8535320E-A0DB-4277-800E-D0CE5BBA59E8",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntipc: re-fetch skb cb after tipc_msg_validate\n\nAs the call trace shows, the original skb was freed in tipc_msg_validate(),\nand dereferencing the old skb cb would cause an use-after-free crash.\n\n  BUG: KASAN: use-after-free in tipc_crypto_rcv_complete+0x1835/0x2240 [tipc]\n  Call Trace:\n   \u003cIRQ\u003e\n   tipc_crypto_rcv_complete+0x1835/0x2240 [tipc]\n   tipc_crypto_rcv+0xd32/0x1ec0 [tipc]\n   tipc_rcv+0x744/0x1150 [tipc]\n  ...\n  Allocated by task 47078:\n   kmem_cache_alloc_node+0x158/0x4d0\n   __alloc_skb+0x1c1/0x270\n   tipc_buf_acquire+0x1e/0xe0 [tipc]\n   tipc_msg_create+0x33/0x1c0 [tipc]\n   tipc_link_build_proto_msg+0x38a/0x2100 [tipc]\n   tipc_link_timeout+0x8b8/0xef0 [tipc]\n   tipc_node_timeout+0x2a1/0x960 [tipc]\n   call_timer_fn+0x2d/0x1c0\n  ...\n  Freed by task 47078:\n   tipc_msg_validate+0x7b/0x440 [tipc]\n   tipc_crypto_rcv_complete+0x4b5/0x2240 [tipc]\n   tipc_crypto_rcv+0xd32/0x1ec0 [tipc]\n   tipc_rcv+0x744/0x1150 [tipc]\n\nThis patch fixes it by re-fetching the skb cb from the new allocated skb\nafter calling tipc_msg_validate()."
          },
          {
            "lang": "es",
            "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: tipc: volver a obtener el skb cb despu\u00e9s de tipc_msg_validate Como muestra el seguimiento de la llamada, el skb original se liber\u00f3 en tipc_msg_validate(), y desreferenciar el antiguo skb cb causar\u00eda un bloqueo por use after free. ERROR: KASAN: use after free en tipc_crypto_rcv_complete+0x1835/0x2240 [tipc] Seguimiento de llamadas:  tipc_crypto_rcv_complete+0x1835/0x2240 [tipc] tipc_crypto_rcv+0xd32/0x1ec0 [tipc] tipc_rcv+0x744/0x1150 [tipc] ... Asignado por la tarea 47078: kmem_cache_alloc_node+0x158/0x4d0 __alloc_skb+0x1c1/0x270 tipc_buf_acquire+0x1e/0xe0 [tipc] tipc_msg_create+0x33/0x1c0 [tipc] tipc_link_build_proto_msg+0x38a/0x2100 [tipc] tipc_link_timeout+0x8b8/0xef0 [tipc] tipc_node_timeout+0x2a1/0x960 [tipc] call_timer_fn+0x2d/0x1c0 ... Liberado por la tarea 47078: tipc_msg_validate+0x7b/0x440 [tipc] tipc_crypto_rcv_complete+0x4b5/0x2240 [tipc] tipc_crypto_rcv+0xd32/0x1ec0 [tipc] tipc_rcv+0x744/0x1150 [tipc] Este parche lo corrige volviendo a obtener el cb skb del nuevo skb asignado despu\u00e9s de llamar a tipc_msg_validate()."
          }
        ],
        "id": "CVE-2022-49017",
        "lastModified": "2026-08-04T10:17:31.180",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 8.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 2.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            },
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "nvd@nist.gov",
              "type": "Primary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2022-49017",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-10-22T13:13:05.882492Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2024-10-21T20:15:12.910",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/1daec0815655e110c6f206c5e777a4af8168ff58"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/3067bc61fcfe3081bf4807ce65560f499e895e77"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/a1ba595e35aa3afbe417ff0af353afb9f65559c0"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/e128190adb2edfd5042105b5d1ed4553f295f5ef"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-416"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-04T19:46:24+00:00",
      "cve": "CVE-2022-49017",
      "id": "CVE-2022-49017",
      "initial_release_date": "2022-01-01T00:00:00+00:00",
      "product_status:known_affected": "156",
      "product_status:known_not_affected": "42",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: tipc: re-fetch skb cb after tipc_msg_validate",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2022/cve-2022-49017.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-11T16:55:48Z",
      "cve": "CVE-2022-49017",
      "id": "CVE-2022-49017",
      "initial_release_date": "2024-10-22T14:22:12Z",
      "product_status:known_affected": "428",
      "product_status:known_not_affected": "355",
      "product_status:recommended": "271",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2022-49017",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2022-49017.json",
      "version": "42"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2022-49017",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2024-10-22T13:13:05.882492Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2024-10-22T13:13:09.030Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "Linux",
              "programFiles": [
                "net/tipc/crypto.c"
              ],
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "vendor": "Linux",
              "versions": [
                {
                  "lessThan": "a1ba595e35aa3afbe417ff0af353afb9f65559c0",
                  "status": "affected",
                  "version": "fc1b6d6de2208774efd2a20bf0daddb02d18b1e0",
                  "versionType": "git"
                },
                {
                  "lessThan": "1daec0815655e110c6f206c5e777a4af8168ff58",
                  "status": "affected",
                  "version": "fc1b6d6de2208774efd2a20bf0daddb02d18b1e0",
                  "versionType": "git"
                },
                {
                  "lessThan": "e128190adb2edfd5042105b5d1ed4553f295f5ef",
                  "status": "affected",
                  "version": "fc1b6d6de2208774efd2a20bf0daddb02d18b1e0",
                  "versionType": "git"
                },
                {
                  "lessThan": "3067bc61fcfe3081bf4807ce65560f499e895e77",
                  "status": "affected",
                  "version": "fc1b6d6de2208774efd2a20bf0daddb02d18b1e0",
                  "versionType": "git"
                }
              ]
            },
            {
              "defaultStatus": "affected",
              "product": "Linux",
              "programFiles": [
                "net/tipc/crypto.c"
              ],
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "vendor": "Linux",
              "versions": [
                {
                  "status": "affected",
                  "version": "5.5"
                },
                {
                  "lessThan": "5.5",
                  "status": "unaffected",
                  "version": "0",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "5.10.*",
                  "status": "unaffected",
                  "version": "5.10.158",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "5.15.*",
                  "status": "unaffected",
                  "version": "5.15.82",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "6.0.*",
                  "status": "unaffected",
                  "version": "6.0.12",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "*",
                  "status": "unaffected",
                  "version": "6.1",
                  "versionType": "original_commit_for_fix"
                }
              ]
            }
          ],
          "cpeApplicability": [
            {
              "nodes": [
                {
                  "cpeMatch": [
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "5.10.158",
                      "versionStartIncluding": "5.5",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "5.15.82",
                      "versionStartIncluding": "5.5",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.0.12",
                      "versionStartIncluding": "5.5",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.1",
                      "versionStartIncluding": "5.5",
                      "vulnerable": true
                    }
                  ],
                  "negate": false,
                  "operator": "OR"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntipc: re-fetch skb cb after tipc_msg_validate\n\nAs the call trace shows, the original skb was freed in tipc_msg_validate(),\nand dereferencing the old skb cb would cause an use-after-free crash.\n\n  BUG: KASAN: use-after-free in tipc_crypto_rcv_complete+0x1835/0x2240 [tipc]\n  Call Trace:\n   \u003cIRQ\u003e\n   tipc_crypto_rcv_complete+0x1835/0x2240 [tipc]\n   tipc_crypto_rcv+0xd32/0x1ec0 [tipc]\n   tipc_rcv+0x744/0x1150 [tipc]\n  ...\n  Allocated by task 47078:\n   kmem_cache_alloc_node+0x158/0x4d0\n   __alloc_skb+0x1c1/0x270\n   tipc_buf_acquire+0x1e/0xe0 [tipc]\n   tipc_msg_create+0x33/0x1c0 [tipc]\n   tipc_link_build_proto_msg+0x38a/0x2100 [tipc]\n   tipc_link_timeout+0x8b8/0xef0 [tipc]\n   tipc_node_timeout+0x2a1/0x960 [tipc]\n   call_timer_fn+0x2d/0x1c0\n  ...\n  Freed by task 47078:\n   tipc_msg_validate+0x7b/0x440 [tipc]\n   tipc_crypto_rcv_complete+0x4b5/0x2240 [tipc]\n   tipc_crypto_rcv+0xd32/0x1ec0 [tipc]\n   tipc_rcv+0x744/0x1150 [tipc]\n\nThis patch fixes it by re-fetching the skb cb from the new allocated skb\nafter calling tipc_msg_validate()."
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "baseScore": 8.8,
                "baseSeverity": "HIGH",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "scenarios": [
                {
                  "lang": "en",
                  "value": "AV:N - The vulnerable path is tipc_udp_recv/tipc_l2_rcv_msg \u2192 tipc_rcv \u2192 tipc_crypto_rcv \u2192 tipc_crypto_rcv_complete, reached by processing encrypted TIPC packets from a remote peer over UDP or Ethernet bearers.\nAC:L - A peer who can send valid encrypted TIPC messages reliably drives the decrypt-complete path; the tipc_msg_validate skb replacement triggers on common high-truesize RX buffers (e.g. page-backed skbs), with no race beyond attacker control.\nPR:L - Successful AEAD decryption is required before tipc_msg_validate and the UAF write, so the attacker must possess the cluster/node TIPC encryption key as an authenticated peer, but needs no elevated OS privileges on the victim.\nUI:N - Exploitation is fully driven by attacker-sent encrypted packets; no victim user action is required once a TIPC bearer with crypto is configured and running.\nS:U - This is standard in-kernel memory corruption within the host TIPC stack and does not cross a VM, IOMMU, or other security authority boundary.\nC:H - Use-after-free of the skb control block enables heap reuse and attacker-controlled object contents, which can be leveraged for arbitrary kernel memory disclosure.\nI:H - The bug writes to freed skb-\u003ecb (decrypted flag and possibly tx_clone_ctx memset), giving a UAF write primitive exploitable for corruption and control-flow hijacking.\nA:H - The KASAN report shows a use-after-free crash in IRQ context; the UAF can cause kernel oops/panic and denial of service even when not fully exploited for code execution."
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-08-05T08:53:28.139Z",
            "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "shortName": "Linux"
          },
          "references": [
            {
              "url": "https://git.kernel.org/stable/c/a1ba595e35aa3afbe417ff0af353afb9f65559c0"
            },
            {
              "url": "https://git.kernel.org/stable/c/1daec0815655e110c6f206c5e777a4af8168ff58"
            },
            {
              "url": "https://git.kernel.org/stable/c/e128190adb2edfd5042105b5d1ed4553f295f5ef"
            },
            {
              "url": "https://git.kernel.org/stable/c/3067bc61fcfe3081bf4807ce65560f499e895e77"
            }
          ],
          "title": "tipc: re-fetch skb cb after tipc_msg_validate",
          "x_generator": {
            "engine": "bippy-1.2.0"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "assignerShortName": "Linux",
        "cveId": "CVE-2022-49017",
        "datePublished": "2024-10-21T20:06:25.971Z",
        "dateReserved": "2024-08-22T01:27:53.646Z",
        "dateUpdated": "2026-08-05T08:53:28.139Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.