367 lines
18 KiB
JSON
367 lines
18 KiB
JSON
{
|
|
"dataType": "CVE_RECORD",
|
|
"dataVersion": "5.2",
|
|
"cveMetadata": {
|
|
"cveId": "CVE-2022-50252",
|
|
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
|
"state": "PUBLISHED",
|
|
"assignerShortName": "Linux",
|
|
"dateReserved": "2025-09-15T13:58:00.973Z",
|
|
"datePublished": "2025-09-15T14:02:30.980Z",
|
|
"dateUpdated": "2026-10-15T21:31:19.421Z"
|
|
},
|
|
"containers": {
|
|
"cna": {
|
|
"providerMetadata": {
|
|
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
|
"shortName": "Linux",
|
|
"dateUpdated": "2026-08-05T08:57:56.935Z"
|
|
},
|
|
"descriptions": [
|
|
{
|
|
"lang": "en",
|
|
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nigb: Do not free q_vector unless new one was allocated\n\nAvoid potential use-after-free condition under memory pressure. If the\nkzalloc() fails, q_vector will be freed but left in the original\nadapter->q_vector[v_idx] array position."
|
|
}
|
|
],
|
|
"metrics": [
|
|
{
|
|
"cvssV3_1": {
|
|
"version": "3.1",
|
|
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
|
|
"baseScore": 7.8,
|
|
"baseSeverity": "HIGH"
|
|
},
|
|
"scenarios": [
|
|
{
|
|
"lang": "en",
|
|
"value": "AV:L - The bug is reached only via local ethtool channel reconfiguration (ETHTOOL_SCHANNELS / ETHTOOL_MSG_CHANNELS_SET → igb_set_channels → igb_reinit_queues → igb_alloc_q_vector), not via received network packets or a remote protocol parser.\nAC:L - The attacker fully controls the ethtool -L call that grows q_vector size across the QUEUE_PAIRS threshold, and a local attacker can induce the required kzalloc() failure through memory exhaustion, so success does not depend on conditions outside their influence.\nPR:L - Triggering requires CAP_NET_ADMIN on the netns that owns the igb netdev (ns_capable / GENL_UNS_ADMIN_PERM), which is available to unprivileged userns/container tenants given an igb interface and is not full init-namespace root.\nUI:N - No separate victim action is required; the attacker issues the privileged ethtool/netlink request themselves.\nS:U - This is a host-kernel heap UAF in the igb PF driver with impact confined to the same kernel privilege domain; it is not a VM/IOMMU/sandbox boundary escape.\nC:H - The failed realloc leaves a dangling adapter->q_vector[] pointer to a freed object (including embedded rings/NAPI state), giving a classic UAF read primitive over reclaimable kernel heap memory.\nI:H - The same UAF/double-free of igb_q_vector (containing napi_struct and related pointers) is heap-sprayable into an arbitrary write / control-flow hijack, enabling code execution in kernel context.\nA:H - Use of the dangling q_vector on retry, teardown, or other driver paths causes kernel oops/panic or double-free, so availability impact is high even without a full exploit."
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"affected": [
|
|
{
|
|
"product": "Linux",
|
|
"vendor": "Linux",
|
|
"defaultStatus": "unaffected",
|
|
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
|
|
"programFiles": [
|
|
"drivers/net/ethernet/intel/igb/igb_main.c"
|
|
],
|
|
"versions": [
|
|
{
|
|
"version": "72ddef0506da852dc82f078f37ced8ef4d74a2bf",
|
|
"lessThan": "64ca1969599857143e91aeec4440640656100803",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "72ddef0506da852dc82f078f37ced8ef4d74a2bf",
|
|
"lessThan": "0200f0fbb11e359cc35af72ab10b2ec224e6f633",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "72ddef0506da852dc82f078f37ced8ef4d74a2bf",
|
|
"lessThan": "68e8adbcaf7a8743e473343b38b9dad66e2ac6f3",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "72ddef0506da852dc82f078f37ced8ef4d74a2bf",
|
|
"lessThan": "f96bd8adc8adde25390965a8c1ee81b73cb62075",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "72ddef0506da852dc82f078f37ced8ef4d74a2bf",
|
|
"lessThan": "3cb18dea11196fb4a06f78294cec5e61985e1aff",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "72ddef0506da852dc82f078f37ced8ef4d74a2bf",
|
|
"lessThan": "314f7092b27749bdde44c14095b5533afa2a3bc8",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "72ddef0506da852dc82f078f37ced8ef4d74a2bf",
|
|
"lessThan": "6e399577bd397a517df4b938601108c63769ce0a",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "72ddef0506da852dc82f078f37ced8ef4d74a2bf",
|
|
"lessThan": "56483aecf6b22eb7dff6315b3a174688c6ad494c",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "72ddef0506da852dc82f078f37ced8ef4d74a2bf",
|
|
"lessThan": "0668716506ca66f90d395f36ccdaebc3e0e84801",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "5be042b1917ddf444c20f4e12856535307b37c01",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "a0e26ed623a1e1460c1a191fbc0f37bddab7851a",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "f4b7f93cd34a6153d454a837708fd4203990d1ae",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "3.18.23",
|
|
"lessThan": "3.19",
|
|
"status": "affected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "4.1.9",
|
|
"lessThan": "4.2",
|
|
"status": "affected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "4.2.2",
|
|
"lessThan": "4.3",
|
|
"status": "affected",
|
|
"versionType": "semver"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"product": "Linux",
|
|
"vendor": "Linux",
|
|
"defaultStatus": "affected",
|
|
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
|
|
"programFiles": [
|
|
"drivers/net/ethernet/intel/igb/igb_main.c"
|
|
],
|
|
"versions": [
|
|
{
|
|
"version": "4.3",
|
|
"status": "affected"
|
|
},
|
|
{
|
|
"version": "0",
|
|
"lessThan": "4.3",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "4.9.337",
|
|
"lessThanOrEqual": "4.9.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "4.14.303",
|
|
"lessThanOrEqual": "4.14.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "4.19.270",
|
|
"lessThanOrEqual": "4.19.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "5.4.229",
|
|
"lessThanOrEqual": "5.4.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "5.10.163",
|
|
"lessThanOrEqual": "5.10.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "5.15.86",
|
|
"lessThanOrEqual": "5.15.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.0.16",
|
|
"lessThanOrEqual": "6.0.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.1.2",
|
|
"lessThanOrEqual": "6.1.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.2",
|
|
"lessThanOrEqual": "*",
|
|
"status": "unaffected",
|
|
"versionType": "original_commit_for_fix"
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"cpeApplicability": [
|
|
{
|
|
"nodes": [
|
|
{
|
|
"operator": "OR",
|
|
"negate": false,
|
|
"cpeMatch": [
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "4.3",
|
|
"versionEndExcluding": "4.9.337"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "4.3",
|
|
"versionEndExcluding": "4.14.303"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "4.3",
|
|
"versionEndExcluding": "4.19.270"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "4.3",
|
|
"versionEndExcluding": "5.4.229"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "4.3",
|
|
"versionEndExcluding": "5.10.163"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "4.3",
|
|
"versionEndExcluding": "5.15.86"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "4.3",
|
|
"versionEndExcluding": "6.0.16"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "4.3",
|
|
"versionEndExcluding": "6.1.2"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "4.3",
|
|
"versionEndExcluding": "6.2"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "3.18.23"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "4.1.9"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "4.2.2"
|
|
}
|
|
]
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"references": [
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/64ca1969599857143e91aeec4440640656100803"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/0200f0fbb11e359cc35af72ab10b2ec224e6f633"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/68e8adbcaf7a8743e473343b38b9dad66e2ac6f3"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/f96bd8adc8adde25390965a8c1ee81b73cb62075"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/3cb18dea11196fb4a06f78294cec5e61985e1aff"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/314f7092b27749bdde44c14095b5533afa2a3bc8"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/6e399577bd397a517df4b938601108c63769ce0a"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/56483aecf6b22eb7dff6315b3a174688c6ad494c"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/0668716506ca66f90d395f36ccdaebc3e0e84801"
|
|
}
|
|
],
|
|
"title": "igb: Do not free q_vector unless new one was allocated",
|
|
"x_generator": {
|
|
"engine": "bippy-1.2.0"
|
|
}
|
|
},
|
|
"adp": [
|
|
{
|
|
"metrics": [
|
|
{
|
|
"other": {
|
|
"type": "ssvc",
|
|
"content": {
|
|
"id": "CVE-2022-50252",
|
|
"role": "CISA Coordinator",
|
|
"options": [
|
|
{
|
|
"Exploitation": "none"
|
|
},
|
|
{
|
|
"Automatable": "no"
|
|
},
|
|
{
|
|
"Technical Impact": "total"
|
|
}
|
|
],
|
|
"version": "2.0.3",
|
|
"timestamp": "2026-10-15T21:30:40.430388Z"
|
|
}
|
|
}
|
|
}
|
|
],
|
|
"title": "CISA ADP Vulnrichment",
|
|
"providerMetadata": {
|
|
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
|
"shortName": "CISA-ADP",
|
|
"dateUpdated": "2026-10-15T21:31:19.421Z"
|
|
}
|
|
}
|
|
]
|
|
}
|
|
} |