CVE-2022-48686: nvme-tcp: fix UAF when detecting digest errors
In the Linux kernel, the following vulnerability has been resolved:
nvme-tcp: fix UAF when detecting digest errors
The Linux kernel CVE team has assigned CVE-2022-48686 to this issue.
Upstream advisory: https://lore.kernel.org/linux-cve-announce/2024050342-CVE-2022-48686-5e8e@gregkh/T
Other sources
In the Linux kernel, the following vulnerability has been resolved:
nvme-tcp: fix UAF when detecting digest errors
We should also bail from the iowork loop when we set rdenabled to true, so we don't attempt to read data from the socket when the TCP stream is already out-of-sync or corrupted.
— NVD
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 5.4.213 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 5.10.143 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 5.15.68 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 5.19.9 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 6.0
Event History
Frequently Asked Questions
What is the severity of CVE-2022-48686?
CVE-2022-48686 is considered a medium severity vulnerability due to its potential for unauthorized access and system compromise.
How do I fix CVE-2022-48686?
To mitigate CVE-2022-48686, update your Linux kernel to version 5.4.213, 5.10.143, 5.15.68, 5.19.9, or 6.0, as these versions contain the necessary patches.
What component is affected by CVE-2022-48686?
CVE-2022-48686 affects the NVMe over TCP component in the Linux kernel.
Is CVE-2022-48686 exploitable remotely?
Yes, CVE-2022-48686 may be exploited remotely through manipulated NVMe TCP packets.
Which Linux distributions are likely affected by CVE-2022-48686?
CVE-2022-48686 primarily affects Red Hat-based distributions using the specified vulnerable kernel versions.