CVE-2022-48999

ipv4: Handle attempt to delete multipath route when fib_info contains an nh reference

State: Published
Severity: 7.1 High
Published: Oct 21, 2024
Updated: Aug 5, 2026
Reserved: Aug 22, 2024

Description

In the Linux kernel, the following vulnerability has been resolved:

ipv4: Handle attempt to delete multipath route when fib_info contains an nh reference

Gwangun Jung reported a slab-out-of-bounds access in fib_nh_match: fib_nh_match+0xf98/0x1130 linux-6.0-rc7/net/ipv4/fib_semantics.c:961 fib_table_delete+0x5f3/0xa40 linux-6.0-rc7/net/ipv4/fib_trie.c:1753 inet_rtm_delroute+0x2b3/0x380 linux-6.0-rc7/net/ipv4/fib_frontend.c:874

Separate nexthop objects are mutually exclusive with the legacy multipath spec. Fix fib_nh_match to return if the config for the to be deleted route contains a multipath spec while the fib_info is using a nexthop object.

Scores

CVSS	Score	Vector	Source
3.1	7.1 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	493ced1ac47c48bb86d9d4e8e87df8592be85a0e to before cc3cd130ecfb8b0ae52e235e487bae3f16a24a32Affected 493ced1ac47c48bb86d9d4e8e87df8592be85a0e to before 0b5394229ebae09afc07aabccb5ffd705ffd250eAffected 493ced1ac47c48bb86d9d4e8e87df8592be85a0e to before 25174d91e4a32a24204060d283bd5fa6d0ddf133Affected 493ced1ac47c48bb86d9d4e8e87df8592be85a0e to before bb20a2ae241be846bc3c11ea4b3a3c69e41d51f2Affected 493ced1ac47c48bb86d9d4e8e87df8592be85a0e to before 61b91eb33a69c3be11b259c5ea484505cd79f883Affected
LinuxLinux	5.3Affected before 5.3Not affected 5.4.226 through 5.4.Not affected 5.10.158 through 5.10.Not affected 5.15.82 through 5.15.Not affected 6.0.12 through 6.0.Not affected 6.1 and laterNot affected

Product

Versions

LinuxLinux

493ced1ac47c48bb86d9d4e8e87df8592be85a0e to before cc3cd130ecfb8b0ae52e235e487bae3f16a24a32Affected
493ced1ac47c48bb86d9d4e8e87df8592be85a0e to before 0b5394229ebae09afc07aabccb5ffd705ffd250eAffected
493ced1ac47c48bb86d9d4e8e87df8592be85a0e to before 25174d91e4a32a24204060d283bd5fa6d0ddf133Affected
493ced1ac47c48bb86d9d4e8e87df8592be85a0e to before bb20a2ae241be846bc3c11ea4b3a3c69e41d51f2Affected
493ced1ac47c48bb86d9d4e8e87df8592be85a0e to before 61b91eb33a69c3be11b259c5ea484505cd79f883Affected

LinuxLinux

5.3Affected
before 5.3Not affected
5.4.226 through 5.4.*Not affected
5.10.158 through 5.10.*Not affected
5.15.82 through 5.15.*Not affected
6.0.12 through 6.0.*Not affected
6.1 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.