CVE-2022-49456 (GCVE-0-2022-49456)

Vulnerability from cvelistv5 – Published: 2025-02-26 02:13 – Updated: 2026-05-11 19:00
VLAI
Title
bonding: fix missed rcu protection
Summary
In the Linux kernel, the following vulnerability has been resolved: bonding: fix missed rcu protection When removing the rcu_read_lock in bond_ethtool_get_ts_info() as discussed [1], I didn't notice it could be called via setsockopt, which doesn't hold rcu lock, as syzbot pointed: stack backtrace: CPU: 0 PID: 3599 Comm: syz-executor317 Not tainted 5.18.0-rc5-syzkaller-01392-g01f4685797a5 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106 bond_option_active_slave_get_rcu include/net/bonding.h:353 [inline] bond_ethtool_get_ts_info+0x32c/0x3a0 drivers/net/bonding/bond_main.c:5595 __ethtool_get_ts_info+0x173/0x240 net/ethtool/common.c:554 ethtool_get_phc_vclocks+0x99/0x110 net/ethtool/common.c:568 sock_timestamping_bind_phc net/core/sock.c:869 [inline] sock_set_timestamping+0x3a3/0x7e0 net/core/sock.c:916 sock_setsockopt+0x543/0x2ec0 net/core/sock.c:1221 __sys_setsockopt+0x55e/0x6a0 net/socket.c:2223 __do_sys_setsockopt net/socket.c:2238 [inline] __se_sys_setsockopt net/socket.c:2235 [inline] __x64_sys_setsockopt+0xba/0x150 net/socket.c:2235 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x44/0xae RIP: 0033:0x7f8902c8eb39 Fix it by adding rcu_read_lock and take a ref on the real_dev. Since dev_hold() and dev_put() can take NULL these days, we can skip checking if real_dev exist. [1] https://lore.kernel.org/netdev/27565.1642742439@famine/
Severity
5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: aa6034678e873db8bd5c5a4b73f8b88c469374d6 , < 1b66a533c47d29b38af8e05fbb53b609a5ba3a4e (git)
Affected: aa6034678e873db8bd5c5a4b73f8b88c469374d6 , < 85eed460681da71b359ed906bce4d800081db854 (git)
Affected: aa6034678e873db8bd5c5a4b73f8b88c469374d6 , < 9b80ccda233fa6c59de411bf889cc4d0e028f2c7 (git)
Create a notification for this product.
Linux Linux Affected: 5.17
Unaffected: 0 , < 5.17 (semver)
Unaffected: 5.17.14 , ≤ 5.17.* (semver)
Unaffected: 5.18.3 , ≤ 5.18.* (semver)
Unaffected: 5.19 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/bonding/bond_main.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "1b66a533c47d29b38af8e05fbb53b609a5ba3a4e",
              "status": "affected",
              "version": "aa6034678e873db8bd5c5a4b73f8b88c469374d6",
              "versionType": "git"
            },
            {
              "lessThan": "85eed460681da71b359ed906bce4d800081db854",
              "status": "affected",
              "version": "aa6034678e873db8bd5c5a4b73f8b88c469374d6",
              "versionType": "git"
            },
            {
              "lessThan": "9b80ccda233fa6c59de411bf889cc4d0e028f2c7",
              "status": "affected",
              "version": "aa6034678e873db8bd5c5a4b73f8b88c469374d6",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/bonding/bond_main.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.17"
            },
            {
              "lessThan": "5.17",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.17.*",
              "status": "unaffected",
              "version": "5.17.14",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.18.*",
              "status": "unaffected",
              "version": "5.18.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "5.19",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.17.14",
                  "versionStartIncluding": "5.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.18.3",
                  "versionStartIncluding": "5.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.19",
                  "versionStartIncluding": "5.17",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbonding: fix missed rcu protection\n\nWhen removing the rcu_read_lock in bond_ethtool_get_ts_info() as\ndiscussed [1], I didn\u0027t notice it could be called via setsockopt,\nwhich doesn\u0027t hold rcu lock, as syzbot pointed:\n\n  stack backtrace:\n  CPU: 0 PID: 3599 Comm: syz-executor317 Not tainted 5.18.0-rc5-syzkaller-01392-g01f4685797a5 #0\n  Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011\n  Call Trace:\n   \u003cTASK\u003e\n   __dump_stack lib/dump_stack.c:88 [inline]\n   dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106\n   bond_option_active_slave_get_rcu include/net/bonding.h:353 [inline]\n   bond_ethtool_get_ts_info+0x32c/0x3a0 drivers/net/bonding/bond_main.c:5595\n   __ethtool_get_ts_info+0x173/0x240 net/ethtool/common.c:554\n   ethtool_get_phc_vclocks+0x99/0x110 net/ethtool/common.c:568\n   sock_timestamping_bind_phc net/core/sock.c:869 [inline]\n   sock_set_timestamping+0x3a3/0x7e0 net/core/sock.c:916\n   sock_setsockopt+0x543/0x2ec0 net/core/sock.c:1221\n   __sys_setsockopt+0x55e/0x6a0 net/socket.c:2223\n   __do_sys_setsockopt net/socket.c:2238 [inline]\n   __se_sys_setsockopt net/socket.c:2235 [inline]\n   __x64_sys_setsockopt+0xba/0x150 net/socket.c:2235\n   do_syscall_x64 arch/x86/entry/common.c:50 [inline]\n   do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80\n   entry_SYSCALL_64_after_hwframe+0x44/0xae\n  RIP: 0033:0x7f8902c8eb39\n\nFix it by adding rcu_read_lock and take a ref on the real_dev.\nSince dev_hold() and dev_put() can take NULL these days, we can\nskip checking if real_dev exist.\n\n[1] https://lore.kernel.org/netdev/27565.1642742439@famine/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T19:00:13.862Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/1b66a533c47d29b38af8e05fbb53b609a5ba3a4e"
        },
        {
          "url": "https://git.kernel.org/stable/c/85eed460681da71b359ed906bce4d800081db854"
        },
        {
          "url": "https://git.kernel.org/stable/c/9b80ccda233fa6c59de411bf889cc4d0e028f2c7"
        }
      ],
      "title": "bonding: fix missed rcu protection",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2022-49456",
    "datePublished": "2025-02-26T02:13:04.787Z",
    "dateReserved": "2025-02-26T02:08:31.574Z",
    "dateUpdated": "2026-05-11T19:00:13.862Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2022-49456",
      "date": "2026-07-26",
      "epss": "0.00253",
      "percentile": "0.1686"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2022-49456\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-02-26T07:01:21.950\",\"lastModified\":\"2026-06-17T05:18:06.250\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nbonding: fix missed rcu protection\\n\\nWhen removing the rcu_read_lock in bond_ethtool_get_ts_info() as\\ndiscussed [1], I didn\u0027t notice it could be called via setsockopt,\\nwhich doesn\u0027t hold rcu lock, as syzbot pointed:\\n\\n  stack backtrace:\\n  CPU: 0 PID: 3599 Comm: syz-executor317 Not tainted 5.18.0-rc5-syzkaller-01392-g01f4685797a5 #0\\n  Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011\\n  Call Trace:\\n   \u003cTASK\u003e\\n   __dump_stack lib/dump_stack.c:88 [inline]\\n   dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106\\n   bond_option_active_slave_get_rcu include/net/bonding.h:353 [inline]\\n   bond_ethtool_get_ts_info+0x32c/0x3a0 drivers/net/bonding/bond_main.c:5595\\n   __ethtool_get_ts_info+0x173/0x240 net/ethtool/common.c:554\\n   ethtool_get_phc_vclocks+0x99/0x110 net/ethtool/common.c:568\\n   sock_timestamping_bind_phc net/core/sock.c:869 [inline]\\n   sock_set_timestamping+0x3a3/0x7e0 net/core/sock.c:916\\n   sock_setsockopt+0x543/0x2ec0 net/core/sock.c:1221\\n   __sys_setsockopt+0x55e/0x6a0 net/socket.c:2223\\n   __do_sys_setsockopt net/socket.c:2238 [inline]\\n   __se_sys_setsockopt net/socket.c:2235 [inline]\\n   __x64_sys_setsockopt+0xba/0x150 net/socket.c:2235\\n   do_syscall_x64 arch/x86/entry/common.c:50 [inline]\\n   do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80\\n   entry_SYSCALL_64_after_hwframe+0x44/0xae\\n  RIP: 0033:0x7f8902c8eb39\\n\\nFix it by adding rcu_read_lock and take a ref on the real_dev.\\nSince dev_hold() and dev_put() can take NULL these days, we can\\nskip checking if real_dev exist.\\n\\n[1] https://lore.kernel.org/netdev/27565.1642742439@famine/\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: bonding: se corrige la protecci\u00f3n rcu faltante Al eliminar rcu_read_lock en bond_ethtool_get_ts_info() como se discuti\u00f3 [1], no not\u00e9 que se pod\u00eda llamar a trav\u00e9s de setsockopt, que no mantiene el bloqueo rcu, como se\u00f1al\u00f3 syzbot: seguimiento de pila: CPU: 0 PID: 3599 Comm: syz-executor317 Not tainted 5.18.0-rc5-syzkaller-01392-g01f4685797a5 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace:  __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106 bond_option_active_slave_get_rcu include/net/bonding.h:353 [inline] bond_ethtool_get_ts_info+0x32c/0x3a0 drivers/net/bonding/bond_main.c:5595 __ethtool_get_ts_info+0x173/0x240 net/ethtool/common.c:554 ethtool_get_phc_vclocks+0x99/0x110 net/ethtool/common.c:568 sock_timestamping_bind_phc net/core/sock.c:869 [inline] sock_set_timestamping+0x3a3/0x7e0 net/core/sock.c:916 sock_setsockopt+0x543/0x2ec0 net/core/sock.c:1221 __sys_setsockopt+0x55e/0x6a0 net/socket.c:2223 __do_sys_setsockopt net/socket.c:2238 [inline] __se_sys_setsockopt net/socket.c:2235 [inline] __x64_sys_setsockopt+0xba/0x150 net/socket.c:2235 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x44/0xae RIP: 0033:0x7f8902c8eb39 Fix it by adding rcu_read_lock and take a ref on the real_dev. Since dev_hold() and dev_put() can take NULL these days, we can skip checking if real_dev exist. [1] https://lore.kernel.org/netdev/27565.1642742439@famine/ \"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/net/bonding/bond_main.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"aa6034678e873db8bd5c5a4b73f8b88c469374d6\",\"lessThan\":\"1b66a533c47d29b38af8e05fbb53b609a5ba3a4e\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"aa6034678e873db8bd5c5a4b73f8b88c469374d6\",\"lessThan\":\"85eed460681da71b359ed906bce4d800081db854\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"aa6034678e873db8bd5c5a4b73f8b88c469374d6\",\"lessThan\":\"9b80ccda233fa6c59de411bf889cc4d0e028f2c7\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/net/bonding/bond_main.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5.17\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.17\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.17.14\",\"lessThanOrEqual\":\"5.17.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.18.3\",\"lessThanOrEqual\":\"5.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.19\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-noinfo\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.17.1\",\"versionEndExcluding\":\"5.17.14\",\"matchCriteriaId\":\"1A6ECE07-4D3D-40FC-A74C-2C36A48CB577\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.18\",\"versionEndExcluding\":\"5.18.3\",\"matchCriteriaId\":\"8E122216-2E9E-4B3E-B7B8-D575A45BA3C2\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:5.17:-:*:*:*:*:*:*\",\"matchCriteriaId\":\"A59F7FD3-F505-48BD-8875-F07A33F42F6C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:5.17:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"E6E34B23-78B4-4516-9BD8-61B33F4AC49A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:5.17:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"C030FA3D-03F4-4FB9-9DBF-D08E5CAC51AA\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:5.17:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"B2D2677C-5389-4AE9-869D-0F881E80D923\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:5.17:rc5:*:*:*:*:*:*\",\"matchCriteriaId\":\"EFA3917C-C322-4D92-912D-ECE45B2E7416\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:5.17:rc6:*:*:*:*:*:*\",\"matchCriteriaId\":\"BED18363-5ABC-4639-8BBA-68E771E5BB3F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:5.17:rc7:*:*:*:*:*:*\",\"matchCriteriaId\":\"7F635F96-FA0A-4769-ADE8-232B3AC9116D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:5.17:rc8:*:*:*:*:*:*\",\"matchCriteriaId\":\"FD39FE73-2A9D-4C92-AE7A-CA22F84B228D\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/1b66a533c47d29b38af8e05fbb53b609a5ba3a4e\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/85eed460681da71b359ed906bce4d800081db854\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/9b80ccda233fa6c59de411bf889cc4d0e028f2c7\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-06-29T21:08:14+00:00",
      "cve": "CVE-2022-49456",
      "id": "CVE-2022-49456",
      "initial_release_date": "2022-01-01T00:00:00+00:00",
      "product_status:known_affected": "198",
      "product_status:known_not_affected": "76",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: bonding: fix missed rcu protection",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2022/cve-2022-49456.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-07-25T17:13:38Z",
      "cve": "CVE-2022-49456",
      "id": "CVE-2022-49456",
      "initial_release_date": "2025-02-27T03:06:34Z",
      "product_status:known_not_affected": "352",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2022-49456",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2022-49456.json",
      "version": "14"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.