GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2022-49340 (GCVE-0-2022-49340)

Vulnerability from cvelistv5 – Published: 2025-02-26 02:10 – Updated: 2026-08-05 08:54
VLAI
Title
ip_gre: test csum_start instead of transport header
Summary
In the Linux kernel, the following vulnerability has been resolved: ip_gre: test csum_start instead of transport header GRE with TUNNEL_CSUM will apply local checksum offload on CHECKSUM_PARTIAL packets. ipgre_xmit must validate csum_start after an optional skb_pull, else lco_csum may trigger an overflow. The original check was if (csum && skb_checksum_start(skb) < skb->data) return -EINVAL; This had false positives when skb_checksum_start is undefined: when ip_summed is not CHECKSUM_PARTIAL. A discussed refinement was straightforward if (csum && skb->ip_summed == CHECKSUM_PARTIAL && skb_checksum_start(skb) < skb->data) return -EINVAL; But was eventually revised more thoroughly: - restrict the check to the only branch where needed, in an uncommon GRE path that uses header_ops and calls skb_pull. - test skb_transport_header, which is set along with csum_start in skb_partial_csum_set in the normal header_ops datapath. Turns out skbs can arrive in this branch without the transport header set, e.g., through BPF redirection. Revise the check back to check csum_start directly, and only if CHECKSUM_PARTIAL. Do leave the check in the updated location. Check field regardless of whether TUNNEL_CSUM is configured.
Severity
7.1 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 774430026bd9a472d08c5d3c33351a782315771a , < 7596bd7920985f7fc8579a92e48bc53ce4475b21 (git)
Affected: 3d32ce5472bb2ca720bef84089b85f76a705fd1a , < 3d08bc3a5d9b2106f5c8bcf1adb73147824aa006 (git)
Affected: 87b34cd6485192777f632f92d592f2a71d8801a6 , < fbeb8dfa8b87ef259eef0c89e39b53962a3cf604 (git)
Affected: 8a0ed250f911da31a2aef52101bc707846a800ff , < e6b6f98fc7605c06c0a3baa70f62c534d7b4ce58 (git)
Affected: 8a0ed250f911da31a2aef52101bc707846a800ff , < 0c92d813c7c9ca2212ecd879232e7d87362fce98 (git)
Affected: 8a0ed250f911da31a2aef52101bc707846a800ff , < 0ffa268724656633af5f37a38c212326d98ebe8c (git)
Affected: 8a0ed250f911da31a2aef52101bc707846a800ff , < 8d21e9963bec1aad2280cdd034c8993033ef2948 (git)
Affected: 4bf5d5224ffca069df4501ba5fcc6ded9c002ead (git)
Affected: 4.19.207 , < 4.19.247 (semver)
Affected: 5.4.148 , < 5.4.198 (semver)
Affected: 5.10.68 , < 5.10.122 (semver)
Affected: 5.14.7 , < 5.15 (semver)
guessed Create a notification for this product.
Linux Linux Affected: 5.15
Unaffected: 0 , < 5.15 (semver)
Unaffected: 4.19.247 , ≤ 4.19.* (semver)
Unaffected: 5.4.198 , ≤ 5.4.* (semver)
Unaffected: 5.10.122 , ≤ 5.10.* (semver)
Unaffected: 5.15.47 , ≤ 5.15.* (semver)
Unaffected: 5.17.15 , ≤ 5.17.* (semver)
Unaffected: 5.18.4 , ≤ 5.18.* (semver)
Unaffected: 5.19 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/ipv4/ip_gre.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "7596bd7920985f7fc8579a92e48bc53ce4475b21",
              "status": "affected",
              "version": "774430026bd9a472d08c5d3c33351a782315771a",
              "versionType": "git"
            },
            {
              "lessThan": "3d08bc3a5d9b2106f5c8bcf1adb73147824aa006",
              "status": "affected",
              "version": "3d32ce5472bb2ca720bef84089b85f76a705fd1a",
              "versionType": "git"
            },
            {
              "lessThan": "fbeb8dfa8b87ef259eef0c89e39b53962a3cf604",
              "status": "affected",
              "version": "87b34cd6485192777f632f92d592f2a71d8801a6",
              "versionType": "git"
            },
            {
              "lessThan": "e6b6f98fc7605c06c0a3baa70f62c534d7b4ce58",
              "status": "affected",
              "version": "8a0ed250f911da31a2aef52101bc707846a800ff",
              "versionType": "git"
            },
            {
              "lessThan": "0c92d813c7c9ca2212ecd879232e7d87362fce98",
              "status": "affected",
              "version": "8a0ed250f911da31a2aef52101bc707846a800ff",
              "versionType": "git"
            },
            {
              "lessThan": "0ffa268724656633af5f37a38c212326d98ebe8c",
              "status": "affected",
              "version": "8a0ed250f911da31a2aef52101bc707846a800ff",
              "versionType": "git"
            },
            {
              "lessThan": "8d21e9963bec1aad2280cdd034c8993033ef2948",
              "status": "affected",
              "version": "8a0ed250f911da31a2aef52101bc707846a800ff",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "4bf5d5224ffca069df4501ba5fcc6ded9c002ead",
              "versionType": "git"
            },
            {
              "lessThan": "4.19.247",
              "status": "affected",
              "version": "4.19.207",
              "versionType": "semver"
            },
            {
              "lessThan": "5.4.198",
              "status": "affected",
              "version": "5.4.148",
              "versionType": "semver"
            },
            {
              "lessThan": "5.10.122",
              "status": "affected",
              "version": "5.10.68",
              "versionType": "semver"
            },
            {
              "lessThan": "5.15",
              "status": "affected",
              "version": "5.14.7",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/ipv4/ip_gre.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.15"
            },
            {
              "lessThan": "5.15",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.19.*",
              "status": "unaffected",
              "version": "4.19.247",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.198",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.122",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.47",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.17.*",
              "status": "unaffected",
              "version": "5.17.15",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.18.*",
              "status": "unaffected",
              "version": "5.18.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "5.19",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.19.247",
                  "versionStartIncluding": "4.19.207",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.198",
                  "versionStartIncluding": "5.4.148",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.122",
                  "versionStartIncluding": "5.10.68",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.47",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.17.15",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.18.4",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.19",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.14.7",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nip_gre: test csum_start instead of transport header\n\nGRE with TUNNEL_CSUM will apply local checksum offload on\nCHECKSUM_PARTIAL packets.\n\nipgre_xmit must validate csum_start after an optional skb_pull,\nelse lco_csum may trigger an overflow. The original check was\n\n\tif (csum \u0026\u0026 skb_checksum_start(skb) \u003c skb-\u003edata)\n\t\treturn -EINVAL;\n\nThis had false positives when skb_checksum_start is undefined:\nwhen ip_summed is not CHECKSUM_PARTIAL. A discussed refinement\nwas straightforward\n\n\tif (csum \u0026\u0026 skb-\u003eip_summed == CHECKSUM_PARTIAL \u0026\u0026\n\t    skb_checksum_start(skb) \u003c skb-\u003edata)\n\t\treturn -EINVAL;\n\nBut was eventually revised more thoroughly:\n- restrict the check to the only branch where needed, in an\n  uncommon GRE path that uses header_ops and calls skb_pull.\n- test skb_transport_header, which is set along with csum_start\n  in skb_partial_csum_set in the normal header_ops datapath.\n\nTurns out skbs can arrive in this branch without the transport\nheader set, e.g., through BPF redirection.\n\nRevise the check back to check csum_start directly, and only if\nCHECKSUM_PARTIAL. Do leave the check in the updated location.\nCheck field regardless of whether TUNNEL_CSUM is configured."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The defect is in ipgre_xmit\u2019s header_ops TX path (local send via the GRE netdev, AF_PACKET/splice, or BPF redirect into that device), not in GRE receive or any remote packet parser.\nAC:L - An attacker who can create/use an NBMA/header_ops GRE device with TUNNEL_CSUM and submit a CHECKSUM_PARTIAL skb whose csum_start falls in the pulled region can trigger the bad lco_csum length deterministically; syzbot reproduced the class of crash without races.\nPR:L - Creating or configuring the GRE tunnel and driving the path needs CAP_NET_ADMIN (and often CAP_NET_RAW for packet sockets), both obtainable in a user namespace, so only unprivileged userns access is required\u2014not real init-ns root.\nUI:N - The attacker opens the netns, sets up the tunnel, and sends the crafted skb themselves; no separate victim action is required.\nS:U - Impact stays inside the same host kernel authority (OOB read/oops on that machine\u2019s networking stack); it is not a VM escape, IOMMU bypass, or other cross-boundary break.\nC:H - When csum_start sits before the post-pull/GRE transport header, csum_start-l4_hdr becomes a huge unsigned length into do_csum/csum_partial, yielding an unbounded out-of-bounds read of kernel memory (not a few fixed bytes), scored Confidentiality High per OOB-read guidance.\nI:N - The failure is a pure over-read while building the GRE checksum; there is no OOB write, UAF, or other corruption that yields an arbitrary-write or control-flow hijack primitive.\nA:H - The same huge-length csum_partial walk hits unmapped pages and produces a kernel paging-fault oops/panic (as in the syzbot report), fully denying availability."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T08:54:49.092Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/7596bd7920985f7fc8579a92e48bc53ce4475b21"
        },
        {
          "url": "https://git.kernel.org/stable/c/3d08bc3a5d9b2106f5c8bcf1adb73147824aa006"
        },
        {
          "url": "https://git.kernel.org/stable/c/fbeb8dfa8b87ef259eef0c89e39b53962a3cf604"
        },
        {
          "url": "https://git.kernel.org/stable/c/e6b6f98fc7605c06c0a3baa70f62c534d7b4ce58"
        },
        {
          "url": "https://git.kernel.org/stable/c/0c92d813c7c9ca2212ecd879232e7d87362fce98"
        },
        {
          "url": "https://git.kernel.org/stable/c/0ffa268724656633af5f37a38c212326d98ebe8c"
        },
        {
          "url": "https://git.kernel.org/stable/c/8d21e9963bec1aad2280cdd034c8993033ef2948"
        }
      ],
      "title": "ip_gre: test csum_start instead of transport header",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2022-49340",
    "datePublished": "2025-02-26T02:10:57.322Z",
    "dateReserved": "2025-02-26T02:08:31.541Z",
    "dateUpdated": "2026-08-05T08:54:49.092Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2022-49340",
      "date": "2026-09-15",
      "epss": "0.00281",
      "percentile": "0.2062"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2022-49340\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-02-26T07:01:10.753\",\"lastModified\":\"2026-08-04T10:17:45.080\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nip_gre: test csum_start instead of transport header\\n\\nGRE with TUNNEL_CSUM will apply local checksum offload on\\nCHECKSUM_PARTIAL packets.\\n\\nipgre_xmit must validate csum_start after an optional skb_pull,\\nelse lco_csum may trigger an overflow. The original check was\\n\\n\\tif (csum \u0026\u0026 skb_checksum_start(skb) \u003c skb-\u003edata)\\n\\t\\treturn -EINVAL;\\n\\nThis had false positives when skb_checksum_start is undefined:\\nwhen ip_summed is not CHECKSUM_PARTIAL. A discussed refinement\\nwas straightforward\\n\\n\\tif (csum \u0026\u0026 skb-\u003eip_summed == CHECKSUM_PARTIAL \u0026\u0026\\n\\t    skb_checksum_start(skb) \u003c skb-\u003edata)\\n\\t\\treturn -EINVAL;\\n\\nBut was eventually revised more thoroughly:\\n- restrict the check to the only branch where needed, in an\\n  uncommon GRE path that uses header_ops and calls skb_pull.\\n- test skb_transport_header, which is set along with csum_start\\n  in skb_partial_csum_set in the normal header_ops datapath.\\n\\nTurns out skbs can arrive in this branch without the transport\\nheader set, e.g., through BPF redirection.\\n\\nRevise the check back to check csum_start directly, and only if\\nCHECKSUM_PARTIAL. Do leave the check in the updated location.\\nCheck field regardless of whether TUNNEL_CSUM is configured.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: ip_gre: prueba csum_start en lugar del encabezado de transporte GRE con TUNNEL_CSUM aplicar\u00e1 la descarga de suma de comprobaci\u00f3n local en los paquetes CHECKSUM_PARTIAL. ipgre_xmit debe validar csum_start despu\u00e9s de un skb_pull opcional, de lo contrario lco_csum puede provocar un desbordamiento. La comprobaci\u00f3n original era if (csum \u0026amp;\u0026amp; skb_checksum_start(skb) \u0026lt; skb-\u0026gt;data) return -EINVAL; Esto ten\u00eda falsos positivos cuando skb_checksum_start no est\u00e1 definido: cuando ip_summed no es CHECKSUM_PARTIAL. Una mejora discutida fue sencilla if (csum \u0026amp;\u0026amp; skb-\u0026gt;ip_summed == CHECKSUM_PARTIAL \u0026amp;\u0026amp; skb_checksum_start(skb) \u0026lt; skb-\u0026gt;data) return -EINVAL; Pero finalmente se revis\u00f3 m\u00e1s a fondo: - restringir la verificaci\u00f3n a la \u00fanica rama donde sea necesario, en una ruta GRE poco com\u00fan que usa header_ops y llama a skb_pull. - probar skb_transport_header, que se establece junto con csum_start en skb_partial_csum_set en la ruta de datos header_ops normal. Resulta que skbs puede llegar a esta rama sin el encabezado de transporte establecido, por ejemplo, a trav\u00e9s de la redirecci\u00f3n BPF. Revise la verificaci\u00f3n nuevamente para verificar csum_start directamente, y solo si CHECKSUM_PARTIAL. Deje la verificaci\u00f3n en la ubicaci\u00f3n actualizada. Verifique el campo independientemente de si TUNNEL_CSUM est\u00e1 configurado.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"net/ipv4/ip_gre.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"774430026bd9a472d08c5d3c33351a782315771a\",\"lessThan\":\"7596bd7920985f7fc8579a92e48bc53ce4475b21\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"3d32ce5472bb2ca720bef84089b85f76a705fd1a\",\"lessThan\":\"3d08bc3a5d9b2106f5c8bcf1adb73147824aa006\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"87b34cd6485192777f632f92d592f2a71d8801a6\",\"lessThan\":\"fbeb8dfa8b87ef259eef0c89e39b53962a3cf604\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"8a0ed250f911da31a2aef52101bc707846a800ff\",\"lessThan\":\"e6b6f98fc7605c06c0a3baa70f62c534d7b4ce58\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"8a0ed250f911da31a2aef52101bc707846a800ff\",\"lessThan\":\"0c92d813c7c9ca2212ecd879232e7d87362fce98\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"8a0ed250f911da31a2aef52101bc707846a800ff\",\"lessThan\":\"0ffa268724656633af5f37a38c212326d98ebe8c\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"8a0ed250f911da31a2aef52101bc707846a800ff\",\"lessThan\":\"8d21e9963bec1aad2280cdd034c8993033ef2948\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"4bf5d5224ffca069df4501ba5fcc6ded9c002ead\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"4.19.207\",\"lessThan\":\"4.19.247\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"5.4.148\",\"lessThan\":\"5.4.198\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"5.10.68\",\"lessThan\":\"5.10.122\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"5.14.7\",\"lessThan\":\"5.15\",\"versionType\":\"semver\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"net/ipv4/ip_gre.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5.15\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.15\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"4.19.247\",\"lessThanOrEqual\":\"4.19.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.4.198\",\"lessThanOrEqual\":\"5.4.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.122\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.47\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.17.15\",\"lessThanOrEqual\":\"5.17.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.18.4\",\"lessThanOrEqual\":\"5.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.19\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H\",\"baseScore\":7.1,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.2},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-noinfo\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.19.207\",\"versionEndExcluding\":\"4.19.247\",\"matchCriteriaId\":\"D758AE59-1429-4455-9E8F-244E41414654\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.4.148\",\"versionEndExcluding\":\"5.4.198\",\"matchCriteriaId\":\"778C5851-261F-4070-AE38-F056B612B584\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.10.68\",\"versionEndExcluding\":\"5.10.122\",\"matchCriteriaId\":\"3D30A79A-020A-4BA5-BA90-E965C6B06CBC\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.14.7\",\"versionEndExcluding\":\"5.15.47\",\"matchCriteriaId\":\"31C62BC3-6423-42BD-BD63-22A637FAA2A9\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.16\",\"versionEndExcluding\":\"5.17.15\",\"matchCriteriaId\":\"53E7AA2E-2FB4-45CA-A22B-08B4EDBB51AD\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.18\",\"versionEndExcluding\":\"5.18.4\",\"matchCriteriaId\":\"FA6D643C-6D6A-4821-8A8D-B5776B8F0103\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:5.19:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"A8C30C2D-F82D-4D37-AB48-D76ABFBD5377\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/0c92d813c7c9ca2212ecd879232e7d87362fce98\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/0ffa268724656633af5f37a38c212326d98ebe8c\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/3d08bc3a5d9b2106f5c8bcf1adb73147824aa006\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/7596bd7920985f7fc8579a92e48bc53ce4475b21\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/8d21e9963bec1aad2280cdd034c8993033ef2948\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/e6b6f98fc7605c06c0a3baa70f62c534d7b4ce58\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/fbeb8dfa8b87ef259eef0c89e39b53962a3cf604\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Low",
      "current_release_date": "2026-08-04T22:59:56+00:00",
      "cve": "CVE-2022-49340",
      "id": "CVE-2022-49340",
      "initial_release_date": "2022-01-01T00:00:00+00:00",
      "product_status:fixed": "166",
      "product_status:known_affected": "64",
      "product_status:known_not_affected": "124",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: ip_gre: test csum_start instead of transport header",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2022/cve-2022-49340.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-04T00:35:02Z",
      "cve": "CVE-2022-49340",
      "id": "CVE-2022-49340",
      "initial_release_date": "2025-02-27T03:08:29Z",
      "product_status:known_affected": "128",
      "product_status:known_not_affected": "341",
      "product_status:recommended": "22",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2022-49340",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2022-49340.json",
      "version": "16"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.