In the Linux kernel, the following vulnerability has been resolved: net: fix information leakage in /proc/net/ptype In one net namespace, after creating a packet socket without binding it to a device, users in other net namespaces can observe the new `packet_type` added by this packet socket by reading `/proc/net/ptype` file. This is minor information leakage as packet socket is namespace aware. Add a net pointer in `packet_type` to keep the net namespace of of corresponding packet socket. In `ptype_seq_show`, this net pointer must be checked when it is not NULL.

Metrics

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact Low

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact partial

Affected Vendors & Products

Vendors Products
Redhat
  • Enterprise Linux
  • Rhel Eus

No data.

Package CPE Advisory Released Date
Red Hat Enterprise Linux 8
kernel-rt-0:4.18.0-553.16.1.rt7.357.el8_10 cpe:/a:redhat:enterprise_linux:8::nfv RHSA-2024:5102 2024-08-08T00:00:00Z
kernel-0:4.18.0-553.16.1.el8_10 cpe:/o:redhat:enterprise_linux:8 RHSA-2024:5101 2024-08-08T00:00:00Z
Red Hat Enterprise Linux 8.8 Extended Update Support
kernel-0:4.18.0-477.70.1.el8_8 cpe:/o:redhat:rhel_eus:8.8 RHSA-2024:6206 2024-09-03T00:00:00Z
References
Link Providers
https://git.kernel.org/stable/c/47934e06b65637c88a762d9c98329ae6e3238888 cve-icon cve-icon
https://git.kernel.org/stable/c/839ec7039513a4f84bfbaff953a9393471176bee cve-icon cve-icon
https://git.kernel.org/stable/c/8f88c78d24f6f346919007cd459fd7e51a8c7779 cve-icon cve-icon
https://git.kernel.org/stable/c/b67ad6170c0ea87391bb253f35d1f78857736e54 cve-icon cve-icon
https://git.kernel.org/stable/c/be1ca30331c7923c6f376610c1bd6059be9b1908 cve-icon cve-icon
https://git.kernel.org/stable/c/c38023032a598ec6263e008d62c7f02def72d5c7 cve-icon cve-icon
https://git.kernel.org/stable/c/db044d97460ea792110eb8b971e82569ded536c6 cve-icon cve-icon
https://git.kernel.org/stable/c/e372ecd455b6ebc7720f52bf4b5f5d44d02f2092 cve-icon cve-icon
https://git.kernel.org/stable/c/e43669c77cb3a742b7d84ecdc7c68c4167a7709b cve-icon cve-icon
https://lore.kernel.org/linux-cve-announce/2024062007-CVE-2022-48757-c816@gregkh/T cve-icon
https://nvd.nist.gov/vuln/detail/CVE-2022-48757 cve-icon
https://www.cve.org/CVERecord?id=CVE-2022-48757 cve-icon
History

Wed, 11 Sep 2024 13:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 06 Sep 2024 13:45:00 +0000

Type Values Removed Values Added
First Time appeared Redhat rhel Eus
CPEs cpe:/o:redhat:rhel_eus:8.8
Vendors & Products Redhat rhel Eus

Thu, 08 Aug 2024 19:00:00 +0000

Type Values Removed Values Added
First Time appeared Redhat
Redhat enterprise Linux
CPEs cpe:/a:redhat:enterprise_linux:8::nfv
cpe:/o:redhat:enterprise_linux:8
Vendors & Products Redhat
Redhat enterprise Linux
cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2024-06-20T11:13:36.529Z

Updated: 2024-12-19T08:07:08.856Z

Reserved: 2024-06-20T11:09:39.059Z

Link: CVE-2022-48757

cve-icon Vulnrichment

Updated: 2024-08-03T15:25:01.373Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2024-06-20T12:15:13.823

Modified: 2024-11-21T07:33:57.330

Link: CVE-2022-48757

cve-icon Redhat

Severity : Low

Publid Date: 2024-06-20T00:00:00Z

Links: CVE-2022-48757 - Bugzilla