CVE-2022-49561
In the Linux kernel, the following vulnerability has been resolved: netfilter: conntrack: re-fetch conntrack after insertion In case the conntrack is clashing, insertion can free skb->_nfct and set skb->_nfct to the already-confirmed entry.
Does this matter?
Lower severity and a low EPSS score (0.82%). Track it; it rarely justifies an emergency change on its own.
Description
In the Linux kernel, the following vulnerability has been resolved: netfilter: conntrack: re-fetch conntrack after insertion In case the conntrack is clashing, insertion can free skb->_nfct and set skb->_nfct to the already-confirmed entry. This wasn't found before because the conntrack entry and the extension space used to free'd after an rcu grace period, plus the race needs events enabled to trigger.
- CVSS 3.1
- 5.5 MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
- EPSS
- 0.82% probability · 55th percentile
- CISA KEV
- Not listed
- Affected
- linux/linux kernel
- Source
- 416baaa9-dc9f-4396-8d5f-8c081fb06d67
References
- https://git.kernel.org/stable/c/01989d7eebb61c99bd4b88ebc8e261bd2f02caedPatch
- https://git.kernel.org/stable/c/04e4a11dc723c52db7a36dc58f0d69ce6426f8f0Patch
- https://git.kernel.org/stable/c/04f9e9104c969d8ce10a4a43634f641ed082092dPatch
- https://git.kernel.org/stable/c/56b14ecec97f39118bf85c9ac2438c5a949509edPatch
- https://git.kernel.org/stable/c/91a36ec160ec1a0c8f5352b772dffcbb0b6023e3Patch
- https://git.kernel.org/stable/c/92a999d1963eed0df666284e20055136ceabd12fPatch
- https://git.kernel.org/stable/c/b16bb373988da3ceb0308381634117e18b6ec60dPatch
- https://git.kernel.org/stable/c/e97222b785e70e8973281666d709baad6523d8afPatch
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.