github - ghsa-6492-fqrm-j64v

ghsa-6492-fqrm-j64v

Vulnerability from github

Published

2025-03-10 21:31

Modified

2025-03-10 21:31

Severity ?

4.7 (Medium) - CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H

Details

In the Linux kernel, the following vulnerability has been resolved:

tcp: Fix data-races around sysctl_tcp_l3mdev_accept.

While reading sysctl_tcp_l3mdev_accept, it can be changed concurrently. Thus, we need to add READ_ONCE() to its readers.

Show details on source website

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2022-49599"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-362"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-02-26T07:01:35Z",
    "severity": "MODERATE"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\ntcp: Fix data-races around sysctl_tcp_l3mdev_accept.\n\nWhile reading sysctl_tcp_l3mdev_accept, it can be changed concurrently.\nThus, we need to add READ_ONCE() to its readers.",
  "id": "GHSA-6492-fqrm-j64v",
  "modified": "2025-03-10T21:31:11Z",
  "published": "2025-03-10T21:31:11Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-49599"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/08a75f10679470552a3a443f9aefd1399604d31d"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/1d9c81833dec46ccb52a1d0db970fefb7c4fa071"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/7d38d86b818104cf88961f3aebea34da89364a8e"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/9ba9cd43b5776c27d25e5a32dde9e80bdeb1c6a1"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

CVE-2022-49599 (GCVE-0-2022-49599)

Vulnerability from cvelistv5

Published

2025-02-26 02:23

Modified

2025-10-01 19:36

Severity ?

4.7 (Medium) - CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H

Summary

In the Linux kernel, the following vulnerability has been resolved: tcp: Fix data-races around sysctl_tcp_l3mdev_accept. While reading sysctl_tcp_l3mdev_accept, it can be changed concurrently. Thus, we need to add READ_ONCE() to its readers.

References

URL

Tags

	https://git.kernel.org/stable/c/1d9c81833dec46ccb52a1d0db970fefb7c4fa071
	https://git.kernel.org/stable/c/9ba9cd43b5776c27d25e5a32dde9e80bdeb1c6a1
	https://git.kernel.org/stable/c/7d38d86b818104cf88961f3aebea34da89364a8e
	https://git.kernel.org/stable/c/08a75f10679470552a3a443f9aefd1399604d31d

Impacted products

Vendor

Product

Version

Version: 6dd9a14e92e54895e143f10fef4d0b9abe109aa9
Version: 6dd9a14e92e54895e143f10fef4d0b9abe109aa9
Version: 6dd9a14e92e54895e143f10fef4d0b9abe109aa9
Version: 6dd9a14e92e54895e143f10fef4d0b9abe109aa9

Version: 4.5

Show details on NVD website

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "HIGH",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 4.7,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2022-49599",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-10-01T19:35:25.135382Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-362",
                "description": "CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027)",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-10-01T19:36:52.489Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "include/net/inet_hashtables.h",
            "include/net/inet_sock.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "1d9c81833dec46ccb52a1d0db970fefb7c4fa071",
              "status": "affected",
              "version": "6dd9a14e92e54895e143f10fef4d0b9abe109aa9",
              "versionType": "git"
            },
            {
              "lessThan": "9ba9cd43b5776c27d25e5a32dde9e80bdeb1c6a1",
              "status": "affected",
              "version": "6dd9a14e92e54895e143f10fef4d0b9abe109aa9",
              "versionType": "git"
            },
            {
              "lessThan": "7d38d86b818104cf88961f3aebea34da89364a8e",
              "status": "affected",
              "version": "6dd9a14e92e54895e143f10fef4d0b9abe109aa9",
              "versionType": "git"
            },
            {
              "lessThan": "08a75f10679470552a3a443f9aefd1399604d31d",
              "status": "affected",
              "version": "6dd9a14e92e54895e143f10fef4d0b9abe109aa9",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "include/net/inet_hashtables.h",
            "include/net/inet_sock.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.5"
            },
            {
              "lessThan": "4.5",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.137",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.58",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.18.*",
              "status": "unaffected",
              "version": "5.18.15",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "5.19",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.137",
                  "versionStartIncluding": "4.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.58",
                  "versionStartIncluding": "4.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.18.15",
                  "versionStartIncluding": "4.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.19",
                  "versionStartIncluding": "4.5",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntcp: Fix data-races around sysctl_tcp_l3mdev_accept.\n\nWhile reading sysctl_tcp_l3mdev_accept, it can be changed concurrently.\nThus, we need to add READ_ONCE() to its readers."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-05-04T08:41:30.380Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/1d9c81833dec46ccb52a1d0db970fefb7c4fa071"
        },
        {
          "url": "https://git.kernel.org/stable/c/9ba9cd43b5776c27d25e5a32dde9e80bdeb1c6a1"
        },
        {
          "url": "https://git.kernel.org/stable/c/7d38d86b818104cf88961f3aebea34da89364a8e"
        },
        {
          "url": "https://git.kernel.org/stable/c/08a75f10679470552a3a443f9aefd1399604d31d"
        }
      ],
      "title": "tcp: Fix data-races around sysctl_tcp_l3mdev_accept.",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2022-49599",
    "datePublished": "2025-02-26T02:23:27.958Z",
    "dateReserved": "2025-02-26T02:21:30.413Z",
    "dateUpdated": "2025-10-01T19:36:52.489Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Log in or create an account to share your comment.

Tags

Taxonomy of the tags.

All sightings related to this event Export sightings related to this event

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.