net/packet: fix slab-out-of-bounds access in packet_recvmsg()

MITRE NVD CVE.ORG JSON API

Summary

CVECVE-2022-48839
StatePUBLISHED
AssignerLinux
Source PriorityCVE Program / NVD first with legacy fallback
Published2024-07-16 13:15:11 UTC
Updated2026-08-04 10:17:23 UTC
DescriptionIn the Linux kernel, the following vulnerability has been resolved: net/packet: fix slab-out-of-bounds access in packet_recvmsg() syzbot found that when an AF_PACKET socket is using PACKET_COPY_THRESH and mmap operations, tpacket_rcv() is queueing skbs with garbage in skb->cb[], triggering a too big copy [1] Presumably, users of af_packet using mmap() already gets correct metadata from the mapped buffer, we can simply make sure to clear 12 bytes that might be copied to user space later. BUG: KASAN: stack-out-of-bounds in memcpy include/linux/fortify-string.h:225 [inline] BUG: KASAN: stack-out-of-bounds in packet_recvmsg+0x56c/0x1150 net/packet/af_packet.c:3489 Write of size 165 at addr ffffc9000385fb78 by task syz-executor233/3631 CPU: 0 PID: 3631 Comm: syz-executor233 Not tainted 5.17.0-rc7-syzkaller-02396-g0b3660695e80 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106 print_address_description.constprop.0.cold+0xf/0x336 mm/kasan/report.c:255 __kasan_report mm/kasan/report.c:442 [inline] kasan_report.cold+0x83/0xdf mm/kasan/report.c:459 check_region_inline mm/kasan/generic.c:183 [inline] kasan_check_range+0x13d/0x180 mm/kasan/generic.c:189 memcpy+0x39/0x60 mm/kasan/shadow.c:66 memcpy include/linux/fortify-string.h:225 [inline] packet_recvmsg+0x56c/0x1150 net/packet/af_packet.c:3489 sock_recvmsg_nosec net/socket.c:948 [inline] sock_recvmsg net/socket.c:966 [inline] sock_recvmsg net/socket.c:962 [inline] ____sys_recvmsg+0x2c4/0x600 net/socket.c:2632 ___sys_recvmsg+0x127/0x200 net/socket.c:2674 __sys_recvmsg+0xe2/0x1a0 net/socket.c:2704 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x44/0xae RIP: 0033:0x7fdfd5954c29 Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 41 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007ffcf8e71e48 EFLAGS: 00000246 ORIG_RAX: 000000000000002f RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fdfd5954c29 RDX: 0000000000000000 RSI: 0000000020000500 RDI: 0000000000000005 RBP: 0000000000000000 R08: 000000000000000d R09: 000000000000000d R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffcf8e71e60 R13: 00000000000f4240 R14: 000000000000c1ff R15: 00007ffcf8e71e54 </TASK> addr ffffc9000385fb78 is located in stack of task syz-executor233/3631 at offset 32 in frame: ____sys_recvmsg+0x0/0x600 include/linux/uio.h:246 this frame has 1 object: [32, 160) 'addr' Memory state around the buggy address: ffffc9000385fa80: 00 04 f3 f3 f3 f3 f3 00 00 00 00 00 00 00 00 00 ffffc9000385fb00: 00 00 00 00 00 00 00 00 00 00 00 f1 f1 f1 f1 00 >ffffc9000385fb80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f3 ^ ffffc9000385fc00: f3 f3 f3 00 00 00 00 00 00 00 00 00 00 00 00 f1 ffffc9000385fc80: f1 f1 f1 00 f2 f2 f2 00 f2 f2 f2 00 00 00 00 00 ==================================================================

Risk And Classification

Primary CVSS: v3.1 5.5 MEDIUM from [email protected]

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Problem Types: CWE-125

VersionSourceTypeScoreSeverityVector
3.1[email protected]Primary5.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
3.1416baaa9-dc9f-4396-8d5f-8c081fb06d67Secondary7.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
3.1CNADECLARED7.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CVSS v3.1 Breakdown

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

NVD Known Affected Configurations (CPE 2.3)

TypeVendorProductVersionUpdateEditionLanguage
Operating System Linux Linux Kernel All All All All

Vendor Declared Affected Products

SourceVendorProductVersionPlatforms
CNA Linux Linux affected 0fb375fb9b93b7d822debc6a734052337ccfdb1f b9d5772d60f8e7ef34e290f72fc20e3a4883e7d0 git Not specified
CNA Linux Linux affected 0fb375fb9b93b7d822debc6a734052337ccfdb1f b1e27cda1e3c12b705875bb7e247a97168580e33 git Not specified
CNA Linux Linux affected 0fb375fb9b93b7d822debc6a734052337ccfdb1f a33dd1e6693f80d805155b3f69c18c2f642915da git Not specified
CNA Linux Linux affected 0fb375fb9b93b7d822debc6a734052337ccfdb1f 268dcf1f7b3193bc446ec3d14e08a240e9561e4d git Not specified
CNA Linux Linux affected 0fb375fb9b93b7d822debc6a734052337ccfdb1f 70b7b3c055fd4a464da8da55ff4c1f84269f9b02 git Not specified
CNA Linux Linux affected 0fb375fb9b93b7d822debc6a734052337ccfdb1f a055f5f2841f7522b44a2b1eccb1951b4b03d51a git Not specified
CNA Linux Linux affected 0fb375fb9b93b7d822debc6a734052337ccfdb1f ef591b35176029fdefea38e8388ffa371e18f4b2 git Not specified
CNA Linux Linux affected 0fb375fb9b93b7d822debc6a734052337ccfdb1f c700525fcc06b05adfea78039de02628af79e07a git Not specified
CNA Linux Linux affected 2.6.14 Not specified
CNA Linux Linux unaffected 2.6.14 semver Not specified
CNA Linux Linux unaffected 4.9.308 4.9.* semver Not specified
CNA Linux Linux unaffected 4.14.273 4.14.* semver Not specified
CNA Linux Linux unaffected 4.19.236 4.19.* semver Not specified
CNA Linux Linux unaffected 5.4.187 5.4.* semver Not specified
CNA Linux Linux unaffected 5.10.108 5.10.* semver Not specified
CNA Linux Linux unaffected 5.15.31 5.15.* semver Not specified
CNA Linux Linux unaffected 5.16.17 5.16.* semver Not specified
CNA Linux Linux unaffected 5.17 * original_commit_for_fix Not specified

References

ReferenceSourceLinkTags
git.kernel.org/stable/c/b1e27cda1e3c12b705875bb7e247a97168580e33 af854a3a-2127-422b-91ae-364da2661108 git.kernel.org Mailing List, Patch
git.kernel.org/stable/c/70b7b3c055fd4a464da8da55ff4c1f84269f9b02 af854a3a-2127-422b-91ae-364da2661108 git.kernel.org Mailing List, Patch
git.kernel.org/stable/c/c700525fcc06b05adfea78039de02628af79e07a af854a3a-2127-422b-91ae-364da2661108 git.kernel.org Mailing List, Patch
git.kernel.org/stable/c/ef591b35176029fdefea38e8388ffa371e18f4b2 af854a3a-2127-422b-91ae-364da2661108 git.kernel.org Mailing List, Patch
git.kernel.org/stable/c/a055f5f2841f7522b44a2b1eccb1951b4b03d51a af854a3a-2127-422b-91ae-364da2661108 git.kernel.org Mailing List, Patch
git.kernel.org/stable/c/b9d5772d60f8e7ef34e290f72fc20e3a4883e7d0 af854a3a-2127-422b-91ae-364da2661108 git.kernel.org Mailing List, Patch
git.kernel.org/stable/c/268dcf1f7b3193bc446ec3d14e08a240e9561e4d af854a3a-2127-422b-91ae-364da2661108 git.kernel.org Mailing List, Patch
git.kernel.org/stable/c/a33dd1e6693f80d805155b3f69c18c2f642915da af854a3a-2127-422b-91ae-364da2661108 git.kernel.org Mailing List, Patch
CVE Program record CVE.ORG www.cve.org canonical
NVD vulnerability detail NVD nvd.nist.gov canonical, analysis

© CVE.report 2026

Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.

CVE, CWE, and OVAL are registred trademarks of The MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. This site includes MITRE data granted under the following license.

Free CVE JSON API cve.report/api

CVE.report and Source URL Uptime Status status.cve.report