CVE-2022-48757
net: fix information leakage in /proc/net/ptype
- Published
- Updated
- Reserved
- Assigned by
- Linux
Description
In the Linux kernel, the following vulnerability has been resolved: net: fix information leakage in /proc/net/ptype In one net namespace, after creating a packet socket without binding it to a device, users in other net namespaces can observe the new `packet_type` added by this packet socket by reading `/proc/net/ptype` file. This is minor information leakage as packet socket is namespace aware. Add a net pointer in `packet_type` to keep the net namespace of of corresponding packet socket. In `ptype_seq_show`, this net pointer must be checked when it is not NULL.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| NVDNVD · Analyzed | 3.1 | High7.1 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H |
- EPSS (exploitation in 30 days)
- 0.22% · top 87% of all CVEs (7 Nov 2026)
- CISA SSVC
- Exploitation: none · Automatable: no · Technical impact: partial
The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.1.
Weakness
Affected products
- affected 2feb27dbe00cbb4f7d31f90acf6bd0d751dd0a50 – < 8f88c78d24f6f346919007cd459fd7e51a8c7779
- affected 2feb27dbe00cbb4f7d31f90acf6bd0d751dd0a50 – < be1ca30331c7923c6f376610c1bd6059be9b1908
- affected 2feb27dbe00cbb4f7d31f90acf6bd0d751dd0a50 – < c38023032a598ec6263e008d62c7f02def72d5c7
- affected 2feb27dbe00cbb4f7d31f90acf6bd0d751dd0a50 – < b67ad6170c0ea87391bb253f35d1f78857736e54
- affected 2feb27dbe00cbb4f7d31f90acf6bd0d751dd0a50 – < e372ecd455b6ebc7720f52bf4b5f5d44d02f2092
- affected 2feb27dbe00cbb4f7d31f90acf6bd0d751dd0a50 – < db044d97460ea792110eb8b971e82569ded536c6
- affected 2feb27dbe00cbb4f7d31f90acf6bd0d751dd0a50 – < e43669c77cb3a742b7d84ecdc7c68c4167a7709b
- affected 2feb27dbe00cbb4f7d31f90acf6bd0d751dd0a50 – < 839ec7039513a4f84bfbaff953a9393471176bee
- affected 2feb27dbe00cbb4f7d31f90acf6bd0d751dd0a50 – < 47934e06b65637c88a762d9c98329ae6e3238888
- affected 2.6.26
- unaffected < 2.6.26
- unaffected 4.4.302 – ≤ 4.4.*
- unaffected 4.9.300 – ≤ 4.9.*
- unaffected 4.14.265 – ≤ 4.14.*
- unaffected 4.19.228 – ≤ 4.19.*
- unaffected 5.4.176 – ≤ 5.4.*
- unaffected 5.10.96 – ≤ 5.10.*
- unaffected 5.15.19 – ≤ 5.15.*
- unaffected 5.16.5 – ≤ 5.16.*
- unaffected 5.17 – ≤ *
References (9)
- https://git.kernel.org/stable/c/8f88c78d24f6f346919007cd459fd7e51a8c7779 (opens in a new tab)x_transferred
- https://git.kernel.org/stable/c/be1ca30331c7923c6f376610c1bd6059be9b1908 (opens in a new tab)x_transferred
- https://git.kernel.org/stable/c/c38023032a598ec6263e008d62c7f02def72d5c7 (opens in a new tab)x_transferred
- https://git.kernel.org/stable/c/b67ad6170c0ea87391bb253f35d1f78857736e54 (opens in a new tab)x_transferred
- https://git.kernel.org/stable/c/e372ecd455b6ebc7720f52bf4b5f5d44d02f2092 (opens in a new tab)x_transferred
- https://git.kernel.org/stable/c/db044d97460ea792110eb8b971e82569ded536c6 (opens in a new tab)x_transferred
- https://git.kernel.org/stable/c/e43669c77cb3a742b7d84ecdc7c68c4167a7709b (opens in a new tab)x_transferred
- https://git.kernel.org/stable/c/839ec7039513a4f84bfbaff953a9393471176bee (opens in a new tab)x_transferred
- https://git.kernel.org/stable/c/47934e06b65637c88a762d9c98329ae6e3238888 (opens in a new tab)x_transferred
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://trackcve.app/cve/CVE-2022-48757)Record last updated .