Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
5.5
CVE-2022-48807: ice: Fix KASAN error in LAG NETDEV_UNREGISTER handler
CVE-2022-48807 · published 2 years ago
Summary
In the Linux kernel, the following vulnerability has been resolved: ice: Fix KASAN error in LAG NETDEV_UNREGISTER handler Currently, the same handler is called for both a NETDEV_BONDING_INFO LAG unlink notification as for a NETDEV_UNREGISTER call. This is causing a problem though, since the netde...
What to do
- Update linux kernel to version 5.16.10.
- Update debian linux to version 5.16.10-1.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| – | linux | linux_kernel |
>= 5.14.16, < 5.15 >= 5.15.1, < 5.15.24 >= 5.16, < 5.16.10 5.15 5.17 cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Linux | linux | kernel |
>= 5.16.0, < 5.16.10 Fix: upgrade to 5.16.10
|
| Debian:12 | debian | linux |
< 5.16.10-1 Fix: upgrade to 5.16.10-1
|
Original advisory text
ice: Fix KASAN error in LAG NETDEV_UNREGISTER handler
In the Linux kernel, the following vulnerability has been resolved: ice: Fix KASAN error in LAG NETDEV_UNREGISTER handler Currently, the same handler is called for both a NETDEV_BONDING_INFO LAG unlink notification as for a NETDEV_UNREGISTER call. This is causing a problem though, since the netdev_notifier_info passed has a different structure depending on which event is passed. The problem manifests as a call trace from a BUG: KASAN stack-out-of-bounds error. Fix this by creating a handler specific to NETDEV_UNREGISTER that only is passed valid elements in the netdev_notifier_info struct for the NETDEV_UNREGISTER event. Also included is the removal of an unbalanced dev_put on the peer_netdev and related braces.
References
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/48xxx/CVE-2022-48807... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2022-48807 Vendor Advisory
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git Product
- https://security-tracker.debian.org/tracker/CVE-2022-48807 Vendor Advisory
- https://git.kernel.org/stable/c/bea1898f65b9b7096cb4e73e97c83b94718f1fa1 URL
- https://git.kernel.org/stable/c/f9daedc3ab8f673e3a9374b91a89fbf1174df469 URL
- https://git.kernel.org/stable/c/faa9bcf700ca1a0d09f92502a6b65d3ce313fb46 URL
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Type
CWE-908Use of Uninitialized Resource
Timeline
Published16 Jul 2024
Updated3 Nov 2026
First seen29 Sep 2026
Track software like this
Free during beta