CVE-2022-48757 net: fix information leakage in /proc/net/ptype
Attackers in one network namespace can read packet socket information from other namespaces via /proc/net/ptype, leaking sensitive network configuration data.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-48757?
CVE-2022-48757 is a high-severity vulnerability in Linux kernel, published on 20 Jun 2024. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
net: fix information leakage in /proc/net/ptype
In one net namespace, after creating a packet socket without binding it to a device, users in other net namespaces can observe the new `packet_type` added by this packet socket by reading `/proc/net/ptype` file. This is minor information leakage as packet socket is namespace aware.
Add a net pointer in `packet_type` to keep the net namespace of of corresponding packet socket. In `ptype_seq_show`, this net pointer must be checked when it is not NULL.
Weakness: CWE-668
Which versions are affected by CVE-2022-48757?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2022-48757?
Apply the vendor's patch.
Is CVE-2022-48757 being exploited?
There is no known exploitation of CVE-2022-48757 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as DEBIAN-CVE-2022-48757, GHSA-vvvp-c6hw-m8pj, UBUNTU-CVE-2022-48757.