CVE-2022-49017
tipc: re-fetch skb cb after tipc_msg_validate
- Published
- Updated
- Reserved
- Assigned by
- Linux
Description
In the Linux kernel, the following vulnerability has been resolved: tipc: re-fetch skb cb after tipc_msg_validate As the call trace shows, the original skb was freed in tipc_msg_validate(), and dereferencing the old skb cb would cause an use-after-free crash. BUG: KASAN: use-after-free in tipc_crypto_rcv_complete+0x1835/0x2240 [tipc] Call Trace: <IRQ> tipc_crypto_rcv_complete+0x1835/0x2240 [tipc] tipc_crypto_rcv+0xd32/0x1ec0 [tipc] tipc_rcv+0x744/0x1150 [tipc] ... Allocated by task 47078: kmem_cache_alloc_node+0x158/0x4d0 __alloc_skb+0x1c1/0x270 tipc_buf_acquire+0x1e/0xe0 [tipc] tipc_msg_create+0x33/0x1c0 [tipc] tipc_link_build_proto_msg+0x38a/0x2100 [tipc] tipc_link_timeout+0x8b8/0xef0 [tipc] tipc_node_timeout+0x2a1/0x960 [tipc] call_timer_fn+0x2d/0x1c0 ... Freed by task 47078: tipc_msg_validate+0x7b/0x440 [tipc] tipc_crypto_rcv_complete+0x4b5/0x2240 [tipc] tipc_crypto_rcv+0xd32/0x1ec0 [tipc] tipc_rcv+0x744/0x1150 [tipc] This patch fixes it by re-fetching the skb cb from the new allocated skb after calling tipc_msg_validate().
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| LinuxCNA (assigner) | 3.1 | High8.8 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| NVDNVD · Modified | 3.1 | High7.8 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
- EPSS (exploitation in 30 days)
- 0.64% · top 49% of all CVEs (6 Nov 2026)
- CISA SSVC
- Exploitation: none · Automatable: no · Technical impact: partial
The list uses the assigner's score when there is one, then CISA's, then NVD's: High 8.8.
Weakness
Affected products
- affected fc1b6d6de2208774efd2a20bf0daddb02d18b1e0 – < a1ba595e35aa3afbe417ff0af353afb9f65559c0
- affected fc1b6d6de2208774efd2a20bf0daddb02d18b1e0 – < 1daec0815655e110c6f206c5e777a4af8168ff58
- affected fc1b6d6de2208774efd2a20bf0daddb02d18b1e0 – < e128190adb2edfd5042105b5d1ed4553f295f5ef
- affected fc1b6d6de2208774efd2a20bf0daddb02d18b1e0 – < 3067bc61fcfe3081bf4807ce65560f499e895e77
- affected 5.5
- unaffected < 5.5
- unaffected 5.10.158 – ≤ 5.10.*
- unaffected 5.15.82 – ≤ 5.15.*
- unaffected 6.0.12 – ≤ 6.0.*
- unaffected 6.1 – ≤ *
References (4)
- https://git.kernel.org/stable/c/a1ba595e35aa3afbe417ff0af353afb9f65559c0 (opens in a new tab)
- https://git.kernel.org/stable/c/1daec0815655e110c6f206c5e777a4af8168ff58 (opens in a new tab)
- https://git.kernel.org/stable/c/e128190adb2edfd5042105b5d1ed4553f295f5ef (opens in a new tab)
- https://git.kernel.org/stable/c/3067bc61fcfe3081bf4807ce65560f499e895e77 (opens in a new tab)
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://trackcve.app/cve/CVE-2022-49017)Record last updated .