CVE-2022-49182 (GCVE-0-2022-49182)
Vulnerability from cvelistv5
Published
2025-02-26 01:55
Modified
2026-08-05 08:54
Severity ?
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Summary
In the Linux kernel, the following vulnerability has been resolved: net: hns3: add vlan list lock to protect vlan list When adding port base VLAN, vf VLAN need to remove from HW and modify the vlan state in vf VLAN list as false. If the periodicity task is freeing the same node, it may cause "use after free" error. This patch adds a vlan list lock to protect the vlan list.
References
Impacted products
Vendor Product Version
Linux Linux Version: c6075b193462d9a3930fb41f587f94720658752a
Version: c6075b193462d9a3930fb41f587f94720658752a
Version: c6075b193462d9a3930fb41f587f94720658752a
Version: c6075b193462d9a3930fb41f587f94720658752a
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 7.8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2022-49182",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-03-04T18:04:19.985508Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-416",
                "description": "CWE-416 Use After Free",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-03-04T18:07:17.957Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c",
            "drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "30f0ff7176efe8ac6c55f85bce26ed58bb608758",
              "status": "affected",
              "version": "c6075b193462d9a3930fb41f587f94720658752a",
              "versionType": "git"
            },
            {
              "lessThan": "09e383ca97e798f9954189b741af54b5c51e7a97",
              "status": "affected",
              "version": "c6075b193462d9a3930fb41f587f94720658752a",
              "versionType": "git"
            },
            {
              "lessThan": "f58af41deeab0f45c9c80adf5f2de489ebbac3dd",
              "status": "affected",
              "version": "c6075b193462d9a3930fb41f587f94720658752a",
              "versionType": "git"
            },
            {
              "lessThan": "1932a624ab88ff407d1a1d567fe581faa15dc725",
              "status": "affected",
              "version": "c6075b193462d9a3930fb41f587f94720658752a",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c",
            "drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.1"
            },
            {
              "lessThan": "5.1",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.33",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.16.*",
              "status": "unaffected",
              "version": "5.16.19",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.17.*",
              "status": "unaffected",
              "version": "5.17.2",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "5.18",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.33",
                  "versionStartIncluding": "5.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.16.19",
                  "versionStartIncluding": "5.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.17.2",
                  "versionStartIncluding": "5.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.18",
                  "versionStartIncluding": "5.1",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: hns3: add vlan list lock to protect vlan list\n\nWhen adding port base VLAN, vf VLAN need to remove from HW and modify\nthe vlan state in vf VLAN list as false. If the periodicity task is\nfreeing the same node, it may cause \"use after free\" error.\nThis patch adds a vlan list lock to protect the vlan list."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bug is in the hns3 PF driver\u0027s vlan_list handling, reached via local rtnetlink/netdev ops (ndo_set_vf_vlan, ndo_vlan_rx_add/kill_vid) or VF mailbox processing on the host\u2014not via remote packet parsing or network-facing protocol servers.\nAC:L - An attacker who can drive VLAN/port-base-VLAN configuration controls the rtnl-side list mutate/free paths and can arm vlan_del_fail_bmap (VLAN kill during reset) so the periodic service task frees the same nodes; both sides of the race are attacker-influenced, so complexity is Low.\nPR:L - Entry requires CAP_NET_ADMIN in the netns that owns the hns3 PF/VF, and in the worst reasonable deployment (device/VF delegated into a user or container netns on Kunpeng/SR-IOV hosts) that capability is available via user namespaces without real init-namespace root.\nUI:N - The attacker triggers the race directly through their own VLAN and VF configuration operations; no separate victim action is required.\nS:U - Corruption is confined to the host kernel\u0027s hns3 PF vlan_list objects within the same OS security authority; this is standard local kernel memory corruption, not a VM/IOMMU boundary escape as the primary scored scenario.\nC:H - The race is a heap use-after-free of kzalloc\u0027d hclge_vport_vlan_cfg list nodes; UAF enables reclaim/spray and arbitrary kernel read primitives under the higher-severity rule.\nI:H - The same freed list-node UAF provides a heap write/control-flow hijack primitive typical of kernel slab use-after-free exploitation.\nA:H - Concurrent list walk versus list_del/kfree causes kernel oops/panic (and KASAN use-after-free), which is full availability impact and can be retried."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T08:54:19.865Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/30f0ff7176efe8ac6c55f85bce26ed58bb608758"
        },
        {
          "url": "https://git.kernel.org/stable/c/09e383ca97e798f9954189b741af54b5c51e7a97"
        },
        {
          "url": "https://git.kernel.org/stable/c/f58af41deeab0f45c9c80adf5f2de489ebbac3dd"
        },
        {
          "url": "https://git.kernel.org/stable/c/1932a624ab88ff407d1a1d567fe581faa15dc725"
        }
      ],
      "title": "net: hns3: add vlan list lock to protect vlan list",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2022-49182",
    "datePublished": "2025-02-26T01:55:33.574Z",
    "dateReserved": "2025-02-26T01:49:39.283Z",
    "dateUpdated": "2026-08-05T08:54:19.865Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 7.8, \"attackVector\": \"LOCAL\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"HIGH\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2022-49182\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-03-04T18:04:19.985508Z\"}}}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-416\", \"description\": \"CWE-416 Use After Free\"}]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-03-04T18:04:21.337Z\"}}], \"cna\": {\"title\": \"net: hns3: add vlan list lock to protect vlan list\", \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 7.8, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"AV:L - The bug is in the hns3 PF driver\u0027s vlan_list handling, reached via local rtnetlink/netdev ops (ndo_set_vf_vlan, ndo_vlan_rx_add/kill_vid) or VF mailbox processing on the host\\u2014not via remote packet parsing or network-facing protocol servers.\\nAC:L - An attacker who can drive VLAN/port-base-VLAN configuration controls the rtnl-side list mutate/free paths and can arm vlan_del_fail_bmap (VLAN kill during reset) so the periodic service task frees the same nodes; both sides of the race are attacker-influenced, so complexity is Low.\\nPR:L - Entry requires CAP_NET_ADMIN in the netns that owns the hns3 PF/VF, and in the worst reasonable deployment (device/VF delegated into a user or container netns on Kunpeng/SR-IOV hosts) that capability is available via user namespaces without real init-namespace root.\\nUI:N - The attacker triggers the race directly through their own VLAN and VF configuration operations; no separate victim action is required.\\nS:U - Corruption is confined to the host kernel\u0027s hns3 PF vlan_list objects within the same OS security authority; this is standard local kernel memory corruption, not a VM/IOMMU boundary escape as the primary scored scenario.\\nC:H - The race is a heap use-after-free of kzalloc\u0027d hclge_vport_vlan_cfg list nodes; UAF enables reclaim/spray and arbitrary kernel read primitives under the higher-severity rule.\\nI:H - The same freed list-node UAF provides a heap write/control-flow hijack primitive typical of kernel slab use-after-free exploitation.\\nA:H - Concurrent list walk versus list_del/kfree causes kernel oops/panic (and KASAN use-after-free), which is full availability impact and can be retried.\"}]}], \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"c6075b193462d9a3930fb41f587f94720658752a\", \"lessThan\": \"30f0ff7176efe8ac6c55f85bce26ed58bb608758\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"c6075b193462d9a3930fb41f587f94720658752a\", \"lessThan\": \"09e383ca97e798f9954189b741af54b5c51e7a97\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"c6075b193462d9a3930fb41f587f94720658752a\", \"lessThan\": \"f58af41deeab0f45c9c80adf5f2de489ebbac3dd\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"c6075b193462d9a3930fb41f587f94720658752a\", \"lessThan\": \"1932a624ab88ff407d1a1d567fe581faa15dc725\", \"versionType\": \"git\"}], \"programFiles\": [\"drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c\", \"drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.h\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"5.1\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"5.1\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"5.15.33\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.15.*\"}, {\"status\": \"unaffected\", \"version\": \"5.16.19\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.16.*\"}, {\"status\": \"unaffected\", \"version\": \"5.17.2\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.17.*\"}, {\"status\": \"unaffected\", \"version\": \"5.18\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c\", \"drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.h\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/30f0ff7176efe8ac6c55f85bce26ed58bb608758\"}, {\"url\": \"https://git.kernel.org/stable/c/09e383ca97e798f9954189b741af54b5c51e7a97\"}, {\"url\": \"https://git.kernel.org/stable/c/f58af41deeab0f45c9c80adf5f2de489ebbac3dd\"}, {\"url\": \"https://git.kernel.org/stable/c/1932a624ab88ff407d1a1d567fe581faa15dc725\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnet: hns3: add vlan list lock to protect vlan list\\n\\nWhen adding port base VLAN, vf VLAN need to remove from HW and modify\\nthe vlan state in vf VLAN list as false. If the periodicity task is\\nfreeing the same node, it may cause \\\"use after free\\\" error.\\nThis patch adds a vlan list lock to protect the vlan list.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.15.33\", \"versionStartIncluding\": \"5.1\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.16.19\", \"versionStartIncluding\": \"5.1\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.17.2\", \"versionStartIncluding\": \"5.1\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.18\", \"versionStartIncluding\": \"5.1\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-08-05T08:54:19.865Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2022-49182\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-05T08:54:19.865Z\", \"dateReserved\": \"2025-02-26T01:49:39.283Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2025-02-26T01:55:33.574Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.