CVE-2022-48782

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2022-48782", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-06-20T11:09:39.068Z", "datePublished": "2024-07-16T11:13:19.141Z", "dateUpdated": "2026-08-05T08:52:14.211Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T08:52:14.211Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmctp: fix use after free\n\nClang static analysis reports this problem\nroute.c:425:4: warning: Use of memory after it is freed\n trace_mctp_key_acquire(key);\n ^~~~~~~~~~~~~~~~~~~~~~~~~~~\nWhen mctp_key_add() fails, key is freed but then is later\nused in trace_mctp_key_acquire(). Add an else statement\nto use the key only when mctp_key_add() is successful."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:A - The bug is in mctp_route_input(), reached when ETH_P_MCTP packets are received on MCTP netdevs (I2C/SMBus or serial bindings). Those transports are chassis/management-fabric or link-local interconnects, not Internet-routable L3, so Adjacent matches the highest realistic exposure.\nAC:L - mctp_key_add() fails on a duplicate (src,dest,tag) key, which the code documents as a race with another SOM packet; an attacker who sends concurrent matching fragmented SOM frames controls both sides of that race and can trigger the UAF reliably.\nPR:N - Packet delivery into mctp_pkttype_receive()/mctp_route_input() performs no authentication or capability check on the sender. An on-bus peer needs no local account; CAP_NET_* checks apply only to AF_MCTP bind/sendto, not to wire reception.\nUI:N - Exploitation requires only attacker-sent MCTP frames toward a host with MCTP routing/sockets configured; no victim user action is required.\nS:U - Impact is memory corruption in the receiving kernel\u2019s MCTP stack and does not cross a separate security authority such as a guest-to-host or IOMMU boundary.\nC:H - Use-after-free of struct mctp_sk_key (trace read plus mctp_key_unref on freed storage) enables heap reuse and disclosure of attacker-controlled or adjacent kernel memory.\nI:H - The same UAF/double-free path yields a heap corruption primitive that can be turned into arbitrary write or control-flow hijacking via standard slab shaping.\nA:H - Dereferencing and re-freeing the dropped key causes kernel oops/panic or heap allocator corruption, so availability impact is High even without full exploitation."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/mctp/route.c"], "versions": [{"version": "4f9e1ba6de45aa8797a83f1fe5b82ec4bac16899", "lessThan": "1dd3ecbec5f606b2a526c47925c8634b1a6bb81e", "status": "affected", "versionType": "git"}, {"version": "4f9e1ba6de45aa8797a83f1fe5b82ec4bac16899", "lessThan": "7e5b6a5c8c44310784c88c1c198dde79f6402f7b", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/mctp/route.c"], "versions": [{"version": "5.16", "status": "affected"}, {"version": "0", "lessThan": "5.16", "status": "unaffected", "versionType": "semver"}, {"version": "5.16.11", "lessThanOrEqual": "5.16.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.17", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.16", "versionEndExcluding": "5.16.11"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.16", "versionEndExcluding": "5.17"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/1dd3ecbec5f606b2a526c47925c8634b1a6bb81e"}, {"url": "https://git.kernel.org/stable/c/7e5b6a5c8c44310784c88c1c198dde79f6402f7b"}], "title": "mctp: fix use after free", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T15:25:01.615Z"}, "title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/1dd3ecbec5f606b2a526c47925c8634b1a6bb81e", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/7e5b6a5c8c44310784c88c1c198dde79f6402f7b", "tags": ["x_transferred"]}]}, {"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2022-48782", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-09-10T17:00:14.462603Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-11T17:34:16.927Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/1dd3ecbec5f606b2a526c47925c8634b1a6bb81e", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/7e5b6a5c8c44310784c88c1c198dde79f6402f7b", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T15:25:01.615Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2022-48782", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-09-10T17:00:14.462603Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-11T12:42:21.767Z"}}], "cna": {"title": "mctp: fix use after free", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 8.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}, "scenarios": [{"lang": "en", "value": "AV:A - The bug is in mctp_route_input(), reached when ETH_P_MCTP packets are received on MCTP netdevs (I2C/SMBus or serial bindings). Those transports are chassis/management-fabric or link-local interconnects, not Internet-routable L3, so Adjacent matches the highest realistic exposure.\nAC:L - mctp_key_add() fails on a duplicate (src,dest,tag) key, which the code documents as a race with another SOM packet; an attacker who sends concurrent matching fragmented SOM frames controls both sides of that race and can trigger the UAF reliably.\nPR:N - Packet delivery into mctp_pkttype_receive()/mctp_route_input() performs no authentication or capability check on the sender. An on-bus peer needs no local account; CAP_NET_* checks apply only to AF_MCTP bind/sendto, not to wire reception.\nUI:N - Exploitation requires only attacker-sent MCTP frames toward a host with MCTP routing/sockets configured; no victim user action is required.\nS:U - Impact is memory corruption in the receiving kernel\u2019s MCTP stack and does not cross a separate security authority such as a guest-to-host or IOMMU boundary.\nC:H - Use-after-free of struct mctp_sk_key (trace read plus mctp_key_unref on freed storage) enables heap reuse and disclosure of attacker-controlled or adjacent kernel memory.\nI:H - The same UAF/double-free path yields a heap corruption primitive that can be turned into arbitrary write or control-flow hijacking via standard slab shaping.\nA:H - Dereferencing and re-freeing the dropped key causes kernel oops/panic or heap allocator corruption, so availability impact is High even without full exploitation."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "4f9e1ba6de45aa8797a83f1fe5b82ec4bac16899", "lessThan": "1dd3ecbec5f606b2a526c47925c8634b1a6bb81e", "versionType": "git"}, {"status": "affected", "version": "4f9e1ba6de45aa8797a83f1fe5b82ec4bac16899", "lessThan": "7e5b6a5c8c44310784c88c1c198dde79f6402f7b", "versionType": "git"}], "programFiles": ["net/mctp/route.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "5.16"}, {"status": "unaffected", "version": "0", "lessThan": "5.16", "versionType": "semver"}, {"status": "unaffected", "version": "5.16.11", "versionType": "semver", "lessThanOrEqual": "5.16.*"}, {"status": "unaffected", "version": "5.17", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["net/mctp/route.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/1dd3ecbec5f606b2a526c47925c8634b1a6bb81e"}, {"url": "https://git.kernel.org/stable/c/7e5b6a5c8c44310784c88c1c198dde79f6402f7b"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmctp: fix use after free\n\nClang static analysis reports this problem\nroute.c:425:4: warning: Use of memory after it is freed\n trace_mctp_key_acquire(key);\n ^~~~~~~~~~~~~~~~~~~~~~~~~~~\nWhen mctp_key_add() fails, key is freed but then is later\nused in trace_mctp_key_acquire(). Add an else statement\nto use the key only when mctp_key_add() is successful."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.16.11", "versionStartIncluding": "5.16"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.17", "versionStartIncluding": "5.16"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T08:52:14.211Z"}}}, "cveMetadata": {"cveId": "CVE-2022-48782", "state": "PUBLISHED", "dateUpdated": "2026-08-05T08:52:14.211Z", "dateReserved": "2024-06-20T11:09:39.068Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2024-07-16T11:13:19.141Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["net/mctp/route.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "1dd3ecbec5f606b2a526c47925c8634b1a6bb81e", "status": "affected", "version": "4f9e1ba6de45aa8797a83f1fe5b82ec4bac16899", "versionType": "git"}, {"lessThan": "7e5b6a5c8c44310784c88c1c198dde79f6402f7b", "status": "affected", "version": "4f9e1ba6de45aa8797a83f1fe5b82ec4bac16899", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["net/mctp/route.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "5.16"}, {"lessThan": "5.16", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.16.*", "status": "unaffected", "version": "5.16.11", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "5.17", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "0D327234-5D4A-43DC-A6DF-BCA0CEBEC039", "versionEndExcluding": "5.16.11", "versionStartIncluding": "5.16", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmctp: fix use after free\n\nClang static analysis reports this problem\nroute.c:425:4: warning: Use of memory after it is freed\n trace_mctp_key_acquire(key);\n ^~~~~~~~~~~~~~~~~~~~~~~~~~~\nWhen mctp_key_add() fails, key is freed but then is later\nused in trace_mctp_key_acquire(). Add an else statement\nto use the key only when mctp_key_add() is successful."}, {"lang": "es", "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: mctp: corregir el use after free El an\u00e1lisis est\u00e1tico de Clang informa este problema route.c:425:4: advertencia: uso de la memoria despu\u00e9s de liberarla trace_mctp_key_acquire(key); ^~~~~~~~~~~~~~~~~~~~~~~~~~~ Cuando mctp_key_add() falla, la clave se libera pero luego se usa en trace_mctp_key_acquire(). Agregue una declaraci\u00f3n else para usar la clave solo cuando mctp_key_add() sea exitoso."}], "id": "CVE-2022-48782", "lastModified": "2026-08-04T10:17:20.477", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2022-48782", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2024-09-10T17:00:14.462603Z", "version": "2.0.3"}}]}, "published": "2024-07-16T12:15:03.290", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Mailing List", "Patch"], "url": "https://git.kernel.org/stable/c/1dd3ecbec5f606b2a526c47925c8634b1a6bb81e"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Mailing List", "Patch"], "url": "https://git.kernel.org/stable/c/7e5b6a5c8c44310784c88c1c198dde79f6402f7b"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List", "Patch"], "url": "https://git.kernel.org/stable/c/1dd3ecbec5f606b2a526c47925c8634b1a6bb81e"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List", "Patch"], "url": "https://git.kernel.org/stable/c/7e5b6a5c8c44310784c88c1c198dde79f6402f7b"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-416"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: mctp: fix use after free", "id": "2298118", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2298118"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.8", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-416", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nmctp: fix use after free\nClang static analysis reports this problem\nroute.c:425:4: warning: Use of memory after it is freed\ntrace_mctp_key_acquire(key);\n^~~~~~~~~~~~~~~~~~~~~~~~~~~\nWhen mctp_key_add() fails, key is freed but then is later\nused in trace_mctp_key_acquire(). Add an else statement\nto use the key only when mctp_key_add() is successful."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability."}, "name": "CVE-2022-48782", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2024-07-16T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2022-48782\nhttps://nvd.nist.gov/vuln/detail/CVE-2022-48782\nhttps://lore.kernel.org/linux-cve-announce/2024071633-CVE-2022-48782-5032@gregkh/T"], "statement": "Red Hat Enterprise Linux is not impacted by this CVE, as the vulnerability in question does not affect the specific versions or configurations of the Linux kernel used in its distributions. This ensures that users of Red Hat Enterprise Linux are not exposed to the potential risks associated with this issue, and no further action or mitigation is necessary for systems running this operating system.", "threat_severity": "Moderate"}

{}