CVE-2022-48757

Source
https://cve.org/CVERecord?id=CVE-2022-48757
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2022-48757.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2022-48757
Downstream
Published
2024-06-20T11:13:36.529Z
Modified
2026-05-15T11:53:10.248055526Z
Summary
net: fix information leakage in /proc/net/ptype
Details

In the Linux kernel, the following vulnerability has been resolved:

net: fix information leakage in /proc/net/ptype

In one net namespace, after creating a packet socket without binding it to a device, users in other net namespaces can observe the new packet_type added by this packet socket by reading /proc/net/ptype file. This is minor information leakage as packet socket is namespace aware.

Add a net pointer in packet_type to keep the net namespace of of corresponding packet socket. In ptype_seq_show, this net pointer must be checked when it is not NULL.

Database specific
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/48xxx/CVE-2022-48757.json",
    "cna_assigner": "Linux"
}
References

Affected packages

Linux / Kernel

Package

Name
Kernel

Affected ranges

Type
ECOSYSTEM
Events
Introduced
2.6.26
Fixed
4.4.302
Type
ECOSYSTEM
Events
Introduced
4.5.0
Fixed
4.9.300
Type
ECOSYSTEM
Events
Introduced
4.10.0
Fixed
4.14.265
Type
ECOSYSTEM
Events
Introduced
4.15.0
Fixed
4.19.228
Type
ECOSYSTEM
Events
Introduced
4.20.0
Fixed
5.4.176
Type
ECOSYSTEM
Events
Introduced
5.5.0
Fixed
5.10.96
Type
ECOSYSTEM
Events
Introduced
5.11.0
Fixed
5.15.19
Type
ECOSYSTEM
Events
Introduced
5.16.0
Fixed
5.16.5

Database specific

source
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2022-48757.json"