CVE-2022-48686

Description

A use-after-free vulnerability was found in the Linux kernel in drivers/nvme/host/tcp.c in nvme_tcp_io_work. This issue can occur when a local user continues to read data after the connection finishes. This flaw allows a malicious user to cause a use-after-free problem.

Statement

This vulnerability is only for systems where NVME over TCP being used.

Mitigation

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

Common Vulnerability Scoring System (CVSS) Score Details

Info alert:Important note

CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).

CVSS v3 Score Breakdown

Red HatNVDcve.org
Base Score5.37.89.8
Attack VectorNetworkLocalNetwork
Attack ComplexityHighLowLow
Privileges RequiredLowLowNone
User InteractionNoneNoneNone
ScopeUnchangedUnchangedUnchanged
ConfidentialityNoneHighHigh
Integrity ImpactNoneHighHigh
Availability ImpactHighHighHigh

Vector

Red Hat: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H

NVD: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

cve.org: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Red Hat CVSS v3 Score Explanation

Similar to the other nvme (over tcp) CVEs, set PR:L, because it is not possible to attack until user already using NVME by TCP (that requires some privileges and in most cases can happen only in local network, but not necessary, so keeping AV:N). It means that random user cannot connect to NVME (memory) by network, but should have rights to access it.

Frequently Asked Questions

Not sure what something means? Check out our Security Glossary.

Want to get errata notifications? Sign up here.