CVE-2022-49622

Summary

CVE-2022-49622: A vulnerability has been identified in the Linux kernel's netfilter component. When the netfilter returns the verdict "NF_STOLEN," the associated skb (Socket Buffer) might have already been freed. This issue can potentially lead to use-after-free vulnerabilities when tracing is enabled. Specifically, access to skb->nf_trace, skb->mark, computation of trace id, and dumping of packet payload can result in undefined behavior. To mitigate these risks, developers are advised to keep a cached copy of skb->nf_trace in the trace state struct and refresh it whenever the verdict is not "STOLEN." Additionally, skb->mark access should be avoided when the verdict is "STOLEN," and the trace id can be precomputed to prevent the third issue. Only packet dumping should be performed when the verdict is not "STOLEN."

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.