CVE-2022-48673 (GCVE-0-2022-48673)

Vulnerability from cvelistv5 – Published: 2024-05-03 14:51 – Updated: 2026-08-05 08:51
VLAI
Title
net/smc: Fix possible access to freed memory in link clear
Summary
In the Linux kernel, the following vulnerability has been resolved: net/smc: Fix possible access to freed memory in link clear After modifying the QP to the Error state, all RX WR would be completed with WC in IB_WC_WR_FLUSH_ERR status. Current implementation does not wait for it is done, but destroy the QP and free the link group directly. So there is a risk that accessing the freed memory in tasklet context. Here is a crash example: BUG: unable to handle page fault for address: ffffffff8f220860 #PF: supervisor write access in kernel mode #PF: error_code(0x0002) - not-present page PGD f7300e067 P4D f7300e067 PUD f7300f063 PMD 8c4e45063 PTE 800ffff08c9df060 Oops: 0002 [#1] SMP PTI CPU: 1 PID: 0 Comm: swapper/1 Kdump: loaded Tainted: G S OE 5.10.0-0607+ #23 Hardware name: Inspur NF5280M4/YZMB-00689-101, BIOS 4.1.20 07/09/2018 RIP: 0010:native_queued_spin_lock_slowpath+0x176/0x1b0 Code: f3 90 48 8b 32 48 85 f6 74 f6 eb d5 c1 ee 12 83 e0 03 83 ee 01 48 c1 e0 05 48 63 f6 48 05 00 c8 02 00 48 03 04 f5 00 09 98 8e <48> 89 10 8b 42 08 85 c0 75 09 f3 90 8b 42 08 85 c0 74 f7 48 8b 32 RSP: 0018:ffffb3b6c001ebd8 EFLAGS: 00010086 RAX: ffffffff8f220860 RBX: 0000000000000246 RCX: 0000000000080000 RDX: ffff91db1f86c800 RSI: 000000000000173c RDI: ffff91db62bace00 RBP: ffff91db62bacc00 R08: 0000000000000000 R09: c00000010000028b R10: 0000000000055198 R11: ffffb3b6c001ea58 R12: ffff91db80e05010 R13: 000000000000000a R14: 0000000000000006 R15: 0000000000000040 FS: 0000000000000000(0000) GS:ffff91db1f840000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ffffffff8f220860 CR3: 00000001f9580004 CR4: 00000000003706e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <IRQ> _raw_spin_lock_irqsave+0x30/0x40 mlx5_ib_poll_cq+0x4c/0xc50 [mlx5_ib] smc_wr_rx_tasklet_fn+0x56/0xa0 [smc] tasklet_action_common.isra.21+0x66/0x100 __do_softirq+0xd5/0x29c asm_call_irq_on_stack+0x12/0x20 </IRQ> do_softirq_own_stack+0x37/0x40 irq_exit_rcu+0x9d/0xa0 sysvec_call_function_single+0x34/0x80 asm_sysvec_call_function_single+0x12/0x20
Severity
9.8 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator (v2.0.3)
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: bd4ad57718cc86d2972a20f9791cd079996a4dd6 , < 89fcb70f1acd6b0bbf2f7bfbf45d7aa75a9bdcde (git)
Affected: bd4ad57718cc86d2972a20f9791cd079996a4dd6 , < e9b1a4f867ae9c1dbd1d71cd09cbdb3239fb4968 (git)
Create a notification for this product.
Linux Linux Affected: 4.11
Unaffected: 0 , < 4.11 (semver)
Unaffected: 5.19.9 , ≤ 5.19.* (semver)
Unaffected: 6.0 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2022-48673",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-05-31T18:55:55.049793Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-04T17:16:35.822Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T15:17:55.722Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/89fcb70f1acd6b0bbf2f7bfbf45d7aa75a9bdcde"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/e9b1a4f867ae9c1dbd1d71cd09cbdb3239fb4968"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/smc/smc_core.c",
            "net/smc/smc_core.h",
            "net/smc/smc_wr.c",
            "net/smc/smc_wr.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "89fcb70f1acd6b0bbf2f7bfbf45d7aa75a9bdcde",
              "status": "affected",
              "version": "bd4ad57718cc86d2972a20f9791cd079996a4dd6",
              "versionType": "git"
            },
            {
              "lessThan": "e9b1a4f867ae9c1dbd1d71cd09cbdb3239fb4968",
              "status": "affected",
              "version": "bd4ad57718cc86d2972a20f9791cd079996a4dd6",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/smc/smc_core.c",
            "net/smc/smc_core.h",
            "net/smc/smc_wr.c",
            "net/smc/smc_wr.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.11"
            },
            {
              "lessThan": "4.11",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.19.*",
              "status": "unaffected",
              "version": "5.19.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.0",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.19.9",
                  "versionStartIncluding": "4.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.0",
                  "versionStartIncluding": "4.11",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/smc: Fix possible access to freed memory in link clear\n\nAfter modifying the QP to the Error state, all RX WR would be completed\nwith WC in IB_WC_WR_FLUSH_ERR status. Current implementation does not\nwait for it is done, but destroy the QP and free the link group directly.\nSo there is a risk that accessing the freed memory in tasklet context.\n\nHere is a crash example:\n\n BUG: unable to handle page fault for address: ffffffff8f220860\n #PF: supervisor write access in kernel mode\n #PF: error_code(0x0002) - not-present page\n PGD f7300e067 P4D f7300e067 PUD f7300f063 PMD 8c4e45063 PTE 800ffff08c9df060\n Oops: 0002 [#1] SMP PTI\n CPU: 1 PID: 0 Comm: swapper/1 Kdump: loaded Tainted: G S         OE     5.10.0-0607+ #23\n Hardware name: Inspur NF5280M4/YZMB-00689-101, BIOS 4.1.20 07/09/2018\n RIP: 0010:native_queued_spin_lock_slowpath+0x176/0x1b0\n Code: f3 90 48 8b 32 48 85 f6 74 f6 eb d5 c1 ee 12 83 e0 03 83 ee 01 48 c1 e0 05 48 63 f6 48 05 00 c8 02 00 48 03 04 f5 00 09 98 8e \u003c48\u003e 89 10 8b 42 08 85 c0 75 09 f3 90 8b 42 08 85 c0 74 f7 48 8b 32\n RSP: 0018:ffffb3b6c001ebd8 EFLAGS: 00010086\n RAX: ffffffff8f220860 RBX: 0000000000000246 RCX: 0000000000080000\n RDX: ffff91db1f86c800 RSI: 000000000000173c RDI: ffff91db62bace00\n RBP: ffff91db62bacc00 R08: 0000000000000000 R09: c00000010000028b\n R10: 0000000000055198 R11: ffffb3b6c001ea58 R12: ffff91db80e05010\n R13: 000000000000000a R14: 0000000000000006 R15: 0000000000000040\n FS:  0000000000000000(0000) GS:ffff91db1f840000(0000) knlGS:0000000000000000\n CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n CR2: ffffffff8f220860 CR3: 00000001f9580004 CR4: 00000000003706e0\n DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\n DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\n Call Trace:\n  \u003cIRQ\u003e\n  _raw_spin_lock_irqsave+0x30/0x40\n  mlx5_ib_poll_cq+0x4c/0xc50 [mlx5_ib]\n  smc_wr_rx_tasklet_fn+0x56/0xa0 [smc]\n  tasklet_action_common.isra.21+0x66/0x100\n  __do_softirq+0xd5/0x29c\n  asm_call_irq_on_stack+0x12/0x20\n  \u003c/IRQ\u003e\n  do_softirq_own_stack+0x37/0x40\n  irq_exit_rcu+0x9d/0xa0\n  sysvec_call_function_single+0x34/0x80\n  asm_sysvec_call_function_single+0x12/0x20"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - A remote peer reaching an AF_SMC listener drives smc_listen_work through the CLC handshake over TCP/IP; after smc_conn_create/smcr_link_init posts the RoCE QP, peer-driven abort/decline/teardown reaches smcr_link_clear, matching prior SMC listen-path UAF scores (e.g. CVE-2024-56640).\nAC:L - The attacker initiates connect/abort/disconnect loops that both put the QP into Error (flushing RX WRs into the recv tasklet) and free the link without draining the CQ, so they control the race and can retry indefinitely.\nPR:N - The CLC handshake and subsequent link teardown run before any application authentication; an unauthenticated remote peer only needs to reach a listening SMC service\u2014no local account or capability is required.\nUI:N - Once an SMC server is already listening, the attacker alone opens the TCP/SMC connection and forces teardown; no additional victim action is required at exploit time.\nS:U - The UAF corrupts in-kernel SMC/RDMA objects (smc_link, wr_rx buffers, CQ poll state) within the same host kernel authority and does not cross a VM, IOMMU, or sandbox boundary.\nC:H - This is a use-after-free of link/QP-associated memory still referenced from smc_wr_rx_tasklet_fn via qp_context after free; reclaiming that heap object yields an attacker-shaped arbitrary read primitive.\nI:H - The softirq path writes through the freed link (and related IB CQ poll state), enabling classic heap-spray UAF write/control-flow hijack primitives as with other kernel UAFs.\nA:H - The fix commit documents a real kernel oops/page-fault in smc_wr_rx_tasklet_fn \u2192 mlx5_ib_poll_cq on freed memory, so availability impact is a full kernel crash even without further exploitation."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T08:51:42.988Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/89fcb70f1acd6b0bbf2f7bfbf45d7aa75a9bdcde"
        },
        {
          "url": "https://git.kernel.org/stable/c/e9b1a4f867ae9c1dbd1d71cd09cbdb3239fb4968"
        }
      ],
      "title": "net/smc: Fix possible access to freed memory in link clear",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2022-48673",
    "datePublished": "2024-05-03T14:51:44.955Z",
    "dateReserved": "2024-02-25T13:44:28.321Z",
    "dateUpdated": "2026-08-05T08:51:42.988Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2022-48673",
      "date": "2026-08-05",
      "epss": "0.00504",
      "percentile": "0.40354"
    },
    "fkie_nvd": {
      "configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"4.11\", \"versionEndExcluding\": \"5.19.9\", \"matchCriteriaId\": \"5AE3A860-340D-4243-9726-E154B3DF0C06\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnet/smc: Fix possible access to freed memory in link clear\\n\\nAfter modifying the QP to the Error state, all RX WR would be completed\\nwith WC in IB_WC_WR_FLUSH_ERR status. Current implementation does not\\nwait for it is done, but destroy the QP and free the link group directly.\\nSo there is a risk that accessing the freed memory in tasklet context.\\n\\nHere is a crash example:\\n\\n BUG: unable to handle page fault for address: ffffffff8f220860\\n #PF: supervisor write access in kernel mode\\n #PF: error_code(0x0002) - not-present page\\n PGD f7300e067 P4D f7300e067 PUD f7300f063 PMD 8c4e45063 PTE 800ffff08c9df060\\n Oops: 0002 [#1] SMP PTI\\n CPU: 1 PID: 0 Comm: swapper/1 Kdump: loaded Tainted: G S         OE     5.10.0-0607+ #23\\n Hardware name: Inspur NF5280M4/YZMB-00689-101, BIOS 4.1.20 07/09/2018\\n RIP: 0010:native_queued_spin_lock_slowpath+0x176/0x1b0\\n Code: f3 90 48 8b 32 48 85 f6 74 f6 eb d5 c1 ee 12 83 e0 03 83 ee 01 48 c1 e0 05 48 63 f6 48 05 00 c8 02 00 48 03 04 f5 00 09 98 8e \u003c48\u003e 89 10 8b 42 08 85 c0 75 09 f3 90 8b 42 08 85 c0 74 f7 48 8b 32\\n RSP: 0018:ffffb3b6c001ebd8 EFLAGS: 00010086\\n RAX: ffffffff8f220860 RBX: 0000000000000246 RCX: 0000000000080000\\n RDX: ffff91db1f86c800 RSI: 000000000000173c RDI: ffff91db62bace00\\n RBP: ffff91db62bacc00 R08: 0000000000000000 R09: c00000010000028b\\n R10: 0000000000055198 R11: ffffb3b6c001ea58 R12: ffff91db80e05010\\n R13: 000000000000000a R14: 0000000000000006 R15: 0000000000000040\\n FS:  0000000000000000(0000) GS:ffff91db1f840000(0000) knlGS:0000000000000000\\n CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\\n CR2: ffffffff8f220860 CR3: 00000001f9580004 CR4: 00000000003706e0\\n DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\\n DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\\n Call Trace:\\n  \u003cIRQ\u003e\\n  _raw_spin_lock_irqsave+0x30/0x40\\n  mlx5_ib_poll_cq+0x4c/0xc50 [mlx5_ib]\\n  smc_wr_rx_tasklet_fn+0x56/0xa0 [smc]\\n  tasklet_action_common.isra.21+0x66/0x100\\n  __do_softirq+0xd5/0x29c\\n  asm_call_irq_on_stack+0x12/0x20\\n  \u003c/IRQ\u003e\\n  do_softirq_own_stack+0x37/0x40\\n  irq_exit_rcu+0x9d/0xa0\\n  sysvec_call_function_single+0x34/0x80\\n  asm_sysvec_call_function_single+0x12/0x20\"}, {\"lang\": \"es\", \"value\": \"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: net/smc: corrige el posible acceso a la memoria liberada al borrar el enlace. Despu\\u00e9s de modificar el QP al estado de Error, todos los RX WR se completar\\u00edan con WC en estado IB_WC_WR_FLUSH_ERR. La implementaci\\u00f3n actual no espera a que est\\u00e9 terminada, sino que destruye el QP y libera el grupo de enlaces directamente. Por lo tanto, existe el riesgo de acceder a la memoria liberada en el contexto del tasklet. Aqu\\u00ed hay un ejemplo de falla: ERROR: no se puede manejar el error de p\\u00e1gina para la direcci\\u00f3n: ffffffff8f220860 #PF: acceso de escritura del supervisor en modo kernel #PF: error_code(0x0002) - p\\u00e1gina no presente PGD f7300e067 P4D f7300e067 PUD f7300f063 PMD 8c4e45063 PTE 800ffff08c9df060 operaciones: 0002 [#1] SMP PTI CPU: 1 PID: 0 Comunicaciones: intercambiador/1 Kdump: cargado Contaminado: GS OE 5.10.0-0607+ #23 Nombre de hardware: Inspur NF5280M4/YZMB-00689-101, BIOS 4.1.20 07 /09/2018 RIP: 0010:native_queued_spin_lock_slowpath+0x176/0x1b0 C\\u00f3digo: f3 90 48 8b 32 48 85 f6 74 f6 eb d5 c1 ee 12 83 e0 03 83 ee 01 48 c1 e0 05 48 63 f6 48 5 00 c8 02 00 48 03 04 f5 00 09 98 8e \u0026lt;48\u0026gt; 89 10 8b 42 08 85 c0 75 09 f3 90 8b 42 08 85 c0 74 f7 48 8b 32 RSP: 0018:ffffb3b6c001ebd8 EFLAGS: 00010086 RAX: ffffffff8f220860 RBX: 0000000000000246 RCX: 0000000000080000 RDX: ffff91db1f86c800 RSI: 000000000000173c RDI: ffff91db62bace00 RBP: ffff91db62bacc00 R08: 00000000000000000 R09: c00000010000028b R10: 0000000000055 198 R11: ffffb3b6c001ea58 R12: ffff91db80e05010 R13: 000000000000000a R14: 0000000000000006 R15: 0000000000000040 FS: 0000000000000000(0 000) GS:ffff91db1f840000(0000) knlGS:0000000000000000 CS : 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ffffffff8f220860 CR3: 00000001f9580004 CR4: 00000000003706e0 DR0: 0000000000000000 DR1: 0000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Seguimiento de llamadas:  _raw_spin_lock_irqsave+0x30/0x40 _encuesta_cq +0x4c/0xc50 [mlx5_ib] smc_wr_rx_tasklet_fn+0x56/0xa0 [smc] tasklet_action_common.isra.21+0x66/0x100 __do_softirq+0xd5/0x29c asm_call_irq_on_stack+0x12/0x20  n_stack+0x37/0x40 irq_exit_rcu+0x9d/0xa0 sysvec_call_function_single+ 0x34/0x80 asm_sysvec_call_function_single+0x12/0x20\"}]",
      "id": "CVE-2022-48673",
      "lastModified": "2024-11-21T07:33:45.173",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\", \"baseScore\": 5.5, \"baseSeverity\": \"MEDIUM\", \"attackVector\": \"LOCAL\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"LOW\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"NONE\", \"integrityImpact\": \"NONE\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 1.8, \"impactScore\": 3.6}]}",
      "published": "2024-05-03T15:15:07.530",
      "references": "[{\"url\": \"https://git.kernel.org/stable/c/89fcb70f1acd6b0bbf2f7bfbf45d7aa75a9bdcde\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/e9b1a4f867ae9c1dbd1d71cd09cbdb3239fb4968\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/89fcb70f1acd6b0bbf2f7bfbf45d7aa75a9bdcde\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/e9b1a4f867ae9c1dbd1d71cd09cbdb3239fb4968\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\"]}]",
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Modified",
      "weaknesses": "[{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-755\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2022-48673\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-05-03T15:15:07.530\",\"lastModified\":\"2026-08-04T10:17:15.197\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnet/smc: Fix possible access to freed memory in link clear\\n\\nAfter modifying the QP to the Error state, all RX WR would be completed\\nwith WC in IB_WC_WR_FLUSH_ERR status. Current implementation does not\\nwait for it is done, but destroy the QP and free the link group directly.\\nSo there is a risk that accessing the freed memory in tasklet context.\\n\\nHere is a crash example:\\n\\n BUG: unable to handle page fault for address: ffffffff8f220860\\n #PF: supervisor write access in kernel mode\\n #PF: error_code(0x0002) - not-present page\\n PGD f7300e067 P4D f7300e067 PUD f7300f063 PMD 8c4e45063 PTE 800ffff08c9df060\\n Oops: 0002 [#1] SMP PTI\\n CPU: 1 PID: 0 Comm: swapper/1 Kdump: loaded Tainted: G S         OE     5.10.0-0607+ #23\\n Hardware name: Inspur NF5280M4/YZMB-00689-101, BIOS 4.1.20 07/09/2018\\n RIP: 0010:native_queued_spin_lock_slowpath+0x176/0x1b0\\n Code: f3 90 48 8b 32 48 85 f6 74 f6 eb d5 c1 ee 12 83 e0 03 83 ee 01 48 c1 e0 05 48 63 f6 48 05 00 c8 02 00 48 03 04 f5 00 09 98 8e \u003c48\u003e 89 10 8b 42 08 85 c0 75 09 f3 90 8b 42 08 85 c0 74 f7 48 8b 32\\n RSP: 0018:ffffb3b6c001ebd8 EFLAGS: 00010086\\n RAX: ffffffff8f220860 RBX: 0000000000000246 RCX: 0000000000080000\\n RDX: ffff91db1f86c800 RSI: 000000000000173c RDI: ffff91db62bace00\\n RBP: ffff91db62bacc00 R08: 0000000000000000 R09: c00000010000028b\\n R10: 0000000000055198 R11: ffffb3b6c001ea58 R12: ffff91db80e05010\\n R13: 000000000000000a R14: 0000000000000006 R15: 0000000000000040\\n FS:  0000000000000000(0000) GS:ffff91db1f840000(0000) knlGS:0000000000000000\\n CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\\n CR2: ffffffff8f220860 CR3: 00000001f9580004 CR4: 00000000003706e0\\n DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\\n DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\\n Call Trace:\\n  \u003cIRQ\u003e\\n  _raw_spin_lock_irqsave+0x30/0x40\\n  mlx5_ib_poll_cq+0x4c/0xc50 [mlx5_ib]\\n  smc_wr_rx_tasklet_fn+0x56/0xa0 [smc]\\n  tasklet_action_common.isra.21+0x66/0x100\\n  __do_softirq+0xd5/0x29c\\n  asm_call_irq_on_stack+0x12/0x20\\n  \u003c/IRQ\u003e\\n  do_softirq_own_stack+0x37/0x40\\n  irq_exit_rcu+0x9d/0xa0\\n  sysvec_call_function_single+0x34/0x80\\n  asm_sysvec_call_function_single+0x12/0x20\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: net/smc: corrige el posible acceso a la memoria liberada al borrar el enlace. Despu\u00e9s de modificar el QP al estado de Error, todos los RX WR se completar\u00edan con WC en estado IB_WC_WR_FLUSH_ERR. La implementaci\u00f3n actual no espera a que est\u00e9 terminada, sino que destruye el QP y libera el grupo de enlaces directamente. Por lo tanto, existe el riesgo de acceder a la memoria liberada en el contexto del tasklet. Aqu\u00ed hay un ejemplo de falla: ERROR: no se puede manejar el error de p\u00e1gina para la direcci\u00f3n: ffffffff8f220860 #PF: acceso de escritura del supervisor en modo kernel #PF: error_code(0x0002) - p\u00e1gina no presente PGD f7300e067 P4D f7300e067 PUD f7300f063 PMD 8c4e45063 PTE 800ffff08c9df060 operaciones: 0002 [#1] SMP PTI CPU: 1 PID: 0 Comunicaciones: intercambiador/1 Kdump: cargado Contaminado: GS OE 5.10.0-0607+ #23 Nombre de hardware: Inspur NF5280M4/YZMB-00689-101, BIOS 4.1.20 07 /09/2018 RIP: 0010:native_queued_spin_lock_slowpath+0x176/0x1b0 C\u00f3digo: f3 90 48 8b 32 48 85 f6 74 f6 eb d5 c1 ee 12 83 e0 03 83 ee 01 48 c1 e0 05 48 63 f6 48 5 00 c8 02 00 48 03 04 f5 00 09 98 8e \u0026lt;48\u0026gt; 89 10 8b 42 08 85 c0 75 09 f3 90 8b 42 08 85 c0 74 f7 48 8b 32 RSP: 0018:ffffb3b6c001ebd8 EFLAGS: 00010086 RAX: ffffffff8f220860 RBX: 0000000000000246 RCX: 0000000000080000 RDX: ffff91db1f86c800 RSI: 000000000000173c RDI: ffff91db62bace00 RBP: ffff91db62bacc00 R08: 00000000000000000 R09: c00000010000028b R10: 0000000000055 198 R11: ffffb3b6c001ea58 R12: ffff91db80e05010 R13: 000000000000000a R14: 0000000000000006 R15: 0000000000000040 FS: 0000000000000000(0 000) GS:ffff91db1f840000(0000) knlGS:0000000000000000 CS : 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ffffffff8f220860 CR3: 00000001f9580004 CR4: 00000000003706e0 DR0: 0000000000000000 DR1: 0000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Seguimiento de llamadas:  _raw_spin_lock_irqsave+0x30/0x40 _encuesta_cq +0x4c/0xc50 [mlx5_ib] smc_wr_rx_tasklet_fn+0x56/0xa0 [smc] tasklet_action_common.isra.21+0x66/0x100 __do_softirq+0xd5/0x29c asm_call_irq_on_stack+0x12/0x20  n_stack+0x37/0x40 irq_exit_rcu+0x9d/0xa0 sysvec_call_function_single+ 0x34/0x80 asm_sysvec_call_function_single+0x12/0x20\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"net/smc/smc_core.c\",\"net/smc/smc_core.h\",\"net/smc/smc_wr.c\",\"net/smc/smc_wr.h\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"bd4ad57718cc86d2972a20f9791cd079996a4dd6\",\"lessThan\":\"89fcb70f1acd6b0bbf2f7bfbf45d7aa75a9bdcde\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"bd4ad57718cc86d2972a20f9791cd079996a4dd6\",\"lessThan\":\"e9b1a4f867ae9c1dbd1d71cd09cbdb3239fb4968\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"net/smc/smc_core.c\",\"net/smc/smc_core.h\",\"net/smc/smc_wr.c\",\"net/smc/smc_wr.h\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"4.11\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"4.11\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.19.9\",\"lessThanOrEqual\":\"5.19.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.0\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":9.8,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2024-05-31T18:55:55.049793Z\",\"id\":\"CVE-2022-48673\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-755\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.11\",\"versionEndExcluding\":\"5.19.9\",\"matchCriteriaId\":\"5AE3A860-340D-4243-9726-E154B3DF0C06\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/89fcb70f1acd6b0bbf2f7bfbf45d7aa75a9bdcde\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/e9b1a4f867ae9c1dbd1d71cd09cbdb3239fb4968\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/89fcb70f1acd6b0bbf2f7bfbf45d7aa75a9bdcde\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/e9b1a4f867ae9c1dbd1d71cd09cbdb3239fb4968\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Low",
      "current_release_date": "2026-08-04T23:01:49+00:00",
      "cve": "CVE-2022-48673",
      "id": "CVE-2022-48673",
      "initial_release_date": "2022-01-01T00:00:00+00:00",
      "product_status:known_affected": "156",
      "product_status:known_not_affected": "42",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: net/smc: Fix possible access to freed memory in link clear",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2022/cve-2022-48673.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-05T01:18:25Z",
      "cve": "CVE-2022-48673",
      "id": "CVE-2022-48673",
      "initial_release_date": "2024-05-07T02:49:26Z",
      "product_status:known_affected": "280",
      "product_status:known_not_affected": "157",
      "product_status:recommended": "592",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2022-48673",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2022-48673.json",
      "version": "55"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://git.kernel.org/stable/c/89fcb70f1acd6b0bbf2f7bfbf45d7aa75a9bdcde\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/e9b1a4f867ae9c1dbd1d71cd09cbdb3239fb4968\", \"tags\": [\"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-03T15:17:55.722Z\"}}, {\"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2022-48673\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-05-31T18:55:55.049793Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-05-31T18:55:58.287Z\"}, \"title\": \"CISA ADP Vulnrichment\"}], \"cna\": {\"title\": \"net/smc: Fix possible access to freed memory in link clear\", \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 9.8, \"baseSeverity\": \"CRITICAL\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"AV:N - A remote peer reaching an AF_SMC listener drives smc_listen_work through the CLC handshake over TCP/IP; after smc_conn_create/smcr_link_init posts the RoCE QP, peer-driven abort/decline/teardown reaches smcr_link_clear, matching prior SMC listen-path UAF scores (e.g. CVE-2024-56640).\\nAC:L - The attacker initiates connect/abort/disconnect loops that both put the QP into Error (flushing RX WRs into the recv tasklet) and free the link without draining the CQ, so they control the race and can retry indefinitely.\\nPR:N - The CLC handshake and subsequent link teardown run before any application authentication; an unauthenticated remote peer only needs to reach a listening SMC service\\u2014no local account or capability is required.\\nUI:N - Once an SMC server is already listening, the attacker alone opens the TCP/SMC connection and forces teardown; no additional victim action is required at exploit time.\\nS:U - The UAF corrupts in-kernel SMC/RDMA objects (smc_link, wr_rx buffers, CQ poll state) within the same host kernel authority and does not cross a VM, IOMMU, or sandbox boundary.\\nC:H - This is a use-after-free of link/QP-associated memory still referenced from smc_wr_rx_tasklet_fn via qp_context after free; reclaiming that heap object yields an attacker-shaped arbitrary read primitive.\\nI:H - The softirq path writes through the freed link (and related IB CQ poll state), enabling classic heap-spray UAF write/control-flow hijack primitives as with other kernel UAFs.\\nA:H - The fix commit documents a real kernel oops/page-fault in smc_wr_rx_tasklet_fn \\u2192 mlx5_ib_poll_cq on freed memory, so availability impact is a full kernel crash even without further exploitation.\"}]}], \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"bd4ad57718cc86d2972a20f9791cd079996a4dd6\", \"lessThan\": \"89fcb70f1acd6b0bbf2f7bfbf45d7aa75a9bdcde\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"bd4ad57718cc86d2972a20f9791cd079996a4dd6\", \"lessThan\": \"e9b1a4f867ae9c1dbd1d71cd09cbdb3239fb4968\", \"versionType\": \"git\"}], \"programFiles\": [\"net/smc/smc_core.c\", \"net/smc/smc_core.h\", \"net/smc/smc_wr.c\", \"net/smc/smc_wr.h\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"4.11\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"4.11\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"5.19.9\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.19.*\"}, {\"status\": \"unaffected\", \"version\": \"6.0\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"net/smc/smc_core.c\", \"net/smc/smc_core.h\", \"net/smc/smc_wr.c\", \"net/smc/smc_wr.h\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/89fcb70f1acd6b0bbf2f7bfbf45d7aa75a9bdcde\"}, {\"url\": \"https://git.kernel.org/stable/c/e9b1a4f867ae9c1dbd1d71cd09cbdb3239fb4968\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnet/smc: Fix possible access to freed memory in link clear\\n\\nAfter modifying the QP to the Error state, all RX WR would be completed\\nwith WC in IB_WC_WR_FLUSH_ERR status. Current implementation does not\\nwait for it is done, but destroy the QP and free the link group directly.\\nSo there is a risk that accessing the freed memory in tasklet context.\\n\\nHere is a crash example:\\n\\n BUG: unable to handle page fault for address: ffffffff8f220860\\n #PF: supervisor write access in kernel mode\\n #PF: error_code(0x0002) - not-present page\\n PGD f7300e067 P4D f7300e067 PUD f7300f063 PMD 8c4e45063 PTE 800ffff08c9df060\\n Oops: 0002 [#1] SMP PTI\\n CPU: 1 PID: 0 Comm: swapper/1 Kdump: loaded Tainted: G S         OE     5.10.0-0607+ #23\\n Hardware name: Inspur NF5280M4/YZMB-00689-101, BIOS 4.1.20 07/09/2018\\n RIP: 0010:native_queued_spin_lock_slowpath+0x176/0x1b0\\n Code: f3 90 48 8b 32 48 85 f6 74 f6 eb d5 c1 ee 12 83 e0 03 83 ee 01 48 c1 e0 05 48 63 f6 48 05 00 c8 02 00 48 03 04 f5 00 09 98 8e \u003c48\u003e 89 10 8b 42 08 85 c0 75 09 f3 90 8b 42 08 85 c0 74 f7 48 8b 32\\n RSP: 0018:ffffb3b6c001ebd8 EFLAGS: 00010086\\n RAX: ffffffff8f220860 RBX: 0000000000000246 RCX: 0000000000080000\\n RDX: ffff91db1f86c800 RSI: 000000000000173c RDI: ffff91db62bace00\\n RBP: ffff91db62bacc00 R08: 0000000000000000 R09: c00000010000028b\\n R10: 0000000000055198 R11: ffffb3b6c001ea58 R12: ffff91db80e05010\\n R13: 000000000000000a R14: 0000000000000006 R15: 0000000000000040\\n FS:  0000000000000000(0000) GS:ffff91db1f840000(0000) knlGS:0000000000000000\\n CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\\n CR2: ffffffff8f220860 CR3: 00000001f9580004 CR4: 00000000003706e0\\n DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\\n DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\\n Call Trace:\\n  \u003cIRQ\u003e\\n  _raw_spin_lock_irqsave+0x30/0x40\\n  mlx5_ib_poll_cq+0x4c/0xc50 [mlx5_ib]\\n  smc_wr_rx_tasklet_fn+0x56/0xa0 [smc]\\n  tasklet_action_common.isra.21+0x66/0x100\\n  __do_softirq+0xd5/0x29c\\n  asm_call_irq_on_stack+0x12/0x20\\n  \u003c/IRQ\u003e\\n  do_softirq_own_stack+0x37/0x40\\n  irq_exit_rcu+0x9d/0xa0\\n  sysvec_call_function_single+0x34/0x80\\n  asm_sysvec_call_function_single+0x12/0x20\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.19.9\", \"versionStartIncluding\": \"4.11\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.0\", \"versionStartIncluding\": \"4.11\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-08-05T08:51:42.988Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2022-48673\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-05T08:51:42.988Z\", \"dateReserved\": \"2024-02-25T13:44:28.321Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-05-03T14:51:44.955Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.