Riskcovery

CVE-2022-49622

netfilter: nf_tables: avoid skb access on nf_stolen

State
Published
Severity
7.8 High
Published
Feb 26, 2025
Updated
Oct 30, 2026
Reserved
Feb 26, 2025

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

netfilter: nf_tables: avoid skb access on nf_stolen

When verdict is NF_STOLEN, the skb might have been freed.

When tracing is enabled, this can result in a use-after-free: 1. access to skb->nf_trace 2. access to skb->mark 3. computation of trace id 4. dump of packet payload

To avoid 1, keep a cached copy of skb->nf_trace in the trace state struct. Refresh this copy whenever verdict is != STOLEN.

Avoid 2 by skipping skb->mark access if verdict is STOLEN.

3 is avoided by precomputing the trace id.

Only dump the packet when verdict is not "STOLEN".

Scores

CVSSScoreVectorSource
3.17.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HLinux
3.17.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HCISA-ADP

Weaknesses

Affected Products

ProductVersions
LinuxLinux
  • 5efa0fc6d7f7930b18801f07cefae8eeacd6ac02 to before 348218a4601e93de4d1e9fab29837cf656e4bf99Affected
  • 5efa0fc6d7f7930b18801f07cefae8eeacd6ac02 to before 453a67af8bd77463b33cb0336dd7f2341e332d29Affected
  • 5efa0fc6d7f7930b18801f07cefae8eeacd6ac02 to before 0016d5d46d7440729a3132f61a8da3bf7f84e2baAffected
  • 5efa0fc6d7f7930b18801f07cefae8eeacd6ac02 to before e34b9ed96ce3b06c79bf884009b16961ca478f87Affected
LinuxLinux
  • 4.10Affected
  • before 4.10Not affected
  • 5.10.273 through 5.10.*Not affected
  • 5.15.224 through 5.15.*Not affected
  • 5.18.13 through 5.18.*Not affected
  • 5.19 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.