CVE-2022-48711
tipc: improve size validations for received domain records
- Published
- Updated
- Reserved
- Assigned by
- Linux
Description
In the Linux kernel, the following vulnerability has been resolved: tipc: improve size validations for received domain records The function tipc_mon_rcv() allows a node to receive and process domain_record structs from peer nodes to track their views of the network topology. This patch verifies that the number of members in a received domain record does not exceed the limit defined by MAX_MON_DOMAIN, something that may otherwise lead to a stack overflow. tipc_mon_rcv() is called from the function tipc_link_proto_rcv(), where we are reading a 32 bit message data length field into a uint16. To avert any risk of bit overflow, we add an extra sanity check for this in that function. We cannot see that happen with the current code, but future designers being unaware of this risk, may introduce it by allowing delivery of very large (> 64k) sk buffers from the bearer layer. This potential problem was identified by Eric Dumazet. This fixes CVE-2022-0435
Timeline
ID reserved
By Linux
Published
- 2 years later
· 2 years later
Record updated
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| LinuxCNA (assigner) | 3.1 | Critical9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| CISA-ADPADP (enrichment) | 3.1 | Medium5.3 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L |
| NVDNVD · Modified | 3.1 | Medium5.5 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H |
- EPSS (exploitation in 30 days)
- 0.51% · top 57% of all CVEs (7 Nov 2026)
- CISA SSVC
- Exploitation: none · Automatable: no · Technical impact: partial
The list uses the assigner's score when there is one, then CISA's, then NVD's: Critical 9.8.
Weakness
- CWE-noinfo Not enough information
- CWE-787 (opens in a new tab)All about CWE-787 and its CVEs
Affected products
- affected 35c55c9877f8de0ab129fa1a309271d0ecc868b9 – < 175db196e45d6f0e6047eccd09c8ba55465eb131
- affected 35c55c9877f8de0ab129fa1a309271d0ecc868b9 – < fde4ddeadd099bf9fbb9ccbee8e1b5c20d530a2d
- affected 35c55c9877f8de0ab129fa1a309271d0ecc868b9 – < f1af11edd08dd8376f7a84487cbb0ea8203e3a1d
- affected 35c55c9877f8de0ab129fa1a309271d0ecc868b9 – < d692e3406e052dbf9f6d9da0cba36cb763272529
- affected 35c55c9877f8de0ab129fa1a309271d0ecc868b9 – < 3c7e5943553594f68bbc070683db6bb6f6e9e78e
- affected 35c55c9877f8de0ab129fa1a309271d0ecc868b9 – < 1f1788616157b0222b0c2153828b475d95e374a7
- affected 35c55c9877f8de0ab129fa1a309271d0ecc868b9 – < 59ff7514f8c56f166aadca49bcecfa028e0ad50f
- affected 35c55c9877f8de0ab129fa1a309271d0ecc868b9 – < 9aa422ad326634b76309e8ff342c246800621216
- affected 4.8
- unaffected < 4.8
- unaffected 4.9.301 – ≤ 4.9.*
- unaffected 4.14.266 – ≤ 4.14.*
- unaffected 4.19.229 – ≤ 4.19.*
- unaffected 5.4.179 – ≤ 5.4.*
- unaffected 5.10.100 – ≤ 5.10.*
- unaffected 5.15.23 – ≤ 5.15.*
- unaffected 5.16.9 – ≤ 5.16.*
- unaffected 5.17 – ≤ *
References (8)
- https://git.kernel.org/stable/c/175db196e45d6f0e6047eccd09c8ba55465eb131 (opens in a new tab)x_transferred
- https://git.kernel.org/stable/c/fde4ddeadd099bf9fbb9ccbee8e1b5c20d530a2d (opens in a new tab)x_transferred
- https://git.kernel.org/stable/c/f1af11edd08dd8376f7a84487cbb0ea8203e3a1d (opens in a new tab)x_transferred
- https://git.kernel.org/stable/c/d692e3406e052dbf9f6d9da0cba36cb763272529 (opens in a new tab)x_transferred
- https://git.kernel.org/stable/c/3c7e5943553594f68bbc070683db6bb6f6e9e78e (opens in a new tab)x_transferred
- https://git.kernel.org/stable/c/1f1788616157b0222b0c2153828b475d95e374a7 (opens in a new tab)x_transferred
- https://git.kernel.org/stable/c/59ff7514f8c56f166aadca49bcecfa028e0ad50f (opens in a new tab)x_transferred
- https://git.kernel.org/stable/c/9aa422ad326634b76309e8ff342c246800621216 (opens in a new tab)x_transferred
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://trackcve.app/cve/CVE-2022-48711)Record last updated .