CVE-2022-49972 (GCVE-0-2022-49972)
Vulnerability from cvelistv5
Published
2025-06-18 11:00
Modified
2026-08-05 08:56
Severity ?
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Summary
In the Linux kernel, the following vulnerability has been resolved: xsk: Fix corrupted packets for XDP_SHARED_UMEM Fix an issue in XDP_SHARED_UMEM mode together with aligned mode where packets are corrupted for the second and any further sockets bound to the same umem. In other words, this does not affect the first socket bound to the umem. The culprit for this bug is that the initialization of the DMA addresses for the pre-populated xsk buffer pool entries was not performed for any socket but the first one bound to the umem. Only the linear array of DMA addresses was populated. Fix this by populating the DMA addresses in the xsk buffer pool for every socket bound to the same umem.
References
Impacted products
Vendor Product Version
Linux Linux Version: 94033cd8e73b8632bab7c8b7bb54caa4f5616db7
Version: 94033cd8e73b8632bab7c8b7bb54caa4f5616db7
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/xdp/xsk_buff_pool.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "2c75891d56ab6fe5ba0d415bfad91d514a4027cd",
              "status": "affected",
              "version": "94033cd8e73b8632bab7c8b7bb54caa4f5616db7",
              "versionType": "git"
            },
            {
              "lessThan": "58ca14ed98c87cfe0d1408cc65a9745d9e9b7a56",
              "status": "affected",
              "version": "94033cd8e73b8632bab7c8b7bb54caa4f5616db7",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/xdp/xsk_buff_pool.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.16"
            },
            {
              "lessThan": "5.16",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.19.*",
              "status": "unaffected",
              "version": "5.19.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.0",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.19.8",
                  "versionStartIncluding": "5.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.0",
                  "versionStartIncluding": "5.16",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nxsk: Fix corrupted packets for XDP_SHARED_UMEM\n\nFix an issue in XDP_SHARED_UMEM mode together with aligned mode where\npackets are corrupted for the second and any further sockets bound to\nthe same umem. In other words, this does not affect the first socket\nbound to the umem. The culprit for this bug is that the initialization\nof the DMA addresses for the pre-populated xsk buffer pool entries was\nnot performed for any socket but the first one bound to the umem. Only\nthe linear array of DMA addresses was populated. Fix this by populating\nthe DMA addresses in the xsk buffer pool for every socket bound to the\nsame umem."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bug is triggered by creating and binding AF_XDP sockets with XDP_SHARED_UMEM via local syscalls (socket/setsockopt/bind), not by processing unsolicited remote packets alone.\nAC:L - An attacker who can open AF_XDP sockets reliably triggers the bug by binding a second aligned-mode shared-UMEM socket to another queue on the same ZC-capable device; no race or attacker-uncontrollable condition is required.\nPR:L - AF_XDP creation only requires CAP_NET_RAW via ns_capable(net-\u003euser_ns, CAP_NET_RAW), which an unprivileged user can obtain in a user namespace or a container granted NET_RAW, so privileges are Low rather than real host root.\nUI:N - Exploitation requires only the attacker\u2019s own socket setup and traffic on the affected queue; no separate victim action is needed.\nS:U - Impact stays within the host kernel/device security authority (wrong DMA addresses on the local NIC); it does not cross a VM, IOMMU guest boundary, or other security scope.\nC:H - Uninitialized DMA fields remain zero and are used by drivers (e.g. xsk_buff_xdp_get_dma / XDP_TX paths), so the NIC can read from the wrong bus address and disclose memory contents; treat as High under the overestimate rule for DMA misuse.\nI:H - RX paths program descriptors from xskb-\u003eframe_dma before it is initialized, so the NIC can DMA-write packet data to the wrong address and corrupt memory; that is High integrity impact.\nA:H - Bad DMA programming can cause IOMMU faults, device failures, kernel instability, or oopses, which is High availability impact."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T08:56:56.871Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/2c75891d56ab6fe5ba0d415bfad91d514a4027cd"
        },
        {
          "url": "https://git.kernel.org/stable/c/58ca14ed98c87cfe0d1408cc65a9745d9e9b7a56"
        }
      ],
      "title": "xsk: Fix corrupted packets for XDP_SHARED_UMEM",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2022-49972",
    "datePublished": "2025-06-18T11:00:35.382Z",
    "dateReserved": "2025-06-18T10:57:27.384Z",
    "dateUpdated": "2026-08-05T08:56:56.871Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.