{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2022-48786", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-07-16T11:38:08.890Z", "datePublished": "2024-07-16T11:43:43.677Z", "dateUpdated": "2026-08-05T08:52:16.369Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T08:52:16.369Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nvsock: remove vsock from connected table when connect is interrupted by a signal\n\nvsock_connect() expects that the socket could already be in the\nTCP_ESTABLISHED state when the connecting task wakes up with a signal\npending. If this happens the socket will be in the connected table, and\nit is not removed when the socket state is reset. In this situation it's\ncommon for the process to retry connect(), and if the connection is\nsuccessful the socket will be added to the connected table a second\ntime, corrupting the list.\n\nPrevent this by calling vsock_remove_connected() if a signal is received\nwhile waiting for a connection. This is harmless if the socket is not in\nthe connected table, and if it is in the table then removing it will\nprevent list corruption from a double add.\n\nNote for backporting: this patch requires d5afa82c977e (\"vsock: correct\nremoval of socket from the list\"), which is in all current stable trees\nexcept 4.9.y." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:L - The bug is in the AF_VSOCK connect(2) syscall path (vsock_connect); vsock is a local socket family and is not reached by processing remote network packets.\nAC:L - An unprivileged attacker can drive both sides—listen and accept via vsock loopback (CONFIG_VSOCKETS_LOOPBACK defaults to y) or a reachable virtio-vsock peer, and deliver a signal to the connecting task—so the ESTABLISHED-plus-signal window is attacker-controlled and reliably repeatable.\nPR:L - Creating an AF_VSOCK SOCK_STREAM socket and connecting to a non-reserved port requires no capabilities; vsock_create/vsock_connect perform no privilege checks for this path.\nUI:N - The attacker opens the socket, connects, signals their own process, and retries connect without any separate victim action.\nS:U - Corruption is confined to the local kernel's vsock_connected_table and is a standard in-kernel privilege-escalation impact, not a guest-to-host or other cross-boundary escape.\nC:H - Double list_add corrupts kernel list pointers in the connected hash table; corrupted list walks and subsequent list operations can be leveraged as an arbitrary kernel read primitive under standard heap/list exploitation.\nI:H - Re-adding an already-linked connected_table node corrupts the doubly-linked list so later list_del/list traversal can perform attacker-influenced pointer writes, enabling arbitrary write and control-flow hijacking.\nA:H - The corrupted connected table is walked and unlinked on packet lookup and socket release, which can oops/BUG the kernel (including under CONFIG_LIST_HARDENED double-add detection)." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "net/vmw_vsock/af_vsock.c" ], "versions": [ { "version": "d021c344051af91f42c5ba9fdedc176740cbd238", "lessThan": "0bb88f3f7e8d506f3efe46d694964117e20efbfc", "status": "affected", "versionType": "git" }, { "version": "d021c344051af91f42c5ba9fdedc176740cbd238", "lessThan": "e3b3939fd137aab6d00d54bee0ee9244b286a608", "status": "affected", "versionType": "git" }, { "version": "d021c344051af91f42c5ba9fdedc176740cbd238", "lessThan": "2910bcb9f67551a45397735e47b6d456eb8cd549", "status": "affected", "versionType": "git" }, { "version": "d021c344051af91f42c5ba9fdedc176740cbd238", "lessThan": "5f326fe2aef411a6575628f92bd861463ea91df7", "status": "affected", "versionType": "git" }, { "version": "d021c344051af91f42c5ba9fdedc176740cbd238", "lessThan": "87cd1bbd6677411e17369cd4b7389ab1e1fdba44", "status": "affected", "versionType": "git" }, { "version": "d021c344051af91f42c5ba9fdedc176740cbd238", "lessThan": "787468ee7a435777521d33399d012fd591ae2f94", "status": "affected", "versionType": "git" }, { "version": "d021c344051af91f42c5ba9fdedc176740cbd238", "lessThan": "addd62a8cb6fa90aa322365c62487da61f6baab8", "status": "affected", "versionType": "git" }, { "version": "d021c344051af91f42c5ba9fdedc176740cbd238", "lessThan": "b9208492fcaecff8f43915529ae34b3bcb03877c", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "net/vmw_vsock/af_vsock.c" ], "versions": [ { "version": "3.9", "status": "affected" }, { "version": "0", "lessThan": "3.9", "status": "unaffected", "versionType": "semver" }, { "version": "4.9.303", "lessThanOrEqual": "4.9.*", "status": "unaffected", "versionType": "semver" }, { "version": "4.14.268", "lessThanOrEqual": "4.14.*", "status": "unaffected", "versionType": "semver" }, { "version": "4.19.231", "lessThanOrEqual": "4.19.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.4.181", "lessThanOrEqual": "5.4.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.10.102", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.15.25", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.16.11", "lessThanOrEqual": "5.16.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.17", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.9", "versionEndExcluding": "4.9.303" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.9", "versionEndExcluding": "4.14.268" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.9", "versionEndExcluding": "4.19.231" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.9", "versionEndExcluding": "5.4.181" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.9", "versionEndExcluding": "5.10.102" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.9", "versionEndExcluding": "5.15.25" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.9", "versionEndExcluding": "5.16.11" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.9", "versionEndExcluding": "5.17" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/0bb88f3f7e8d506f3efe46d694964117e20efbfc" }, { "url": "https://git.kernel.org/stable/c/e3b3939fd137aab6d00d54bee0ee9244b286a608" }, { "url": "https://git.kernel.org/stable/c/2910bcb9f67551a45397735e47b6d456eb8cd549" }, { "url": "https://git.kernel.org/stable/c/5f326fe2aef411a6575628f92bd861463ea91df7" }, { "url": "https://git.kernel.org/stable/c/87cd1bbd6677411e17369cd4b7389ab1e1fdba44" }, { "url": "https://git.kernel.org/stable/c/787468ee7a435777521d33399d012fd591ae2f94" }, { "url": "https://git.kernel.org/stable/c/addd62a8cb6fa90aa322365c62487da61f6baab8" }, { "url": "https://git.kernel.org/stable/c/b9208492fcaecff8f43915529ae34b3bcb03877c" } ], "title": "vsock: remove vsock from connected table when connect is interrupted by a signal", "x_generator": { "engine": "bippy-1.2.0" } }, "adp": [ { "providerMetadata": { "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T15:25:01.588Z" }, "title": "CVE Program Container", "references": [ { "url": "https://git.kernel.org/stable/c/0bb88f3f7e8d506f3efe46d694964117e20efbfc", "tags": [ "x_transferred" ] }, { "url": "https://git.kernel.org/stable/c/e3b3939fd137aab6d00d54bee0ee9244b286a608", "tags": [ "x_transferred" ] }, { "url": "https://git.kernel.org/stable/c/2910bcb9f67551a45397735e47b6d456eb8cd549", "tags": [ "x_transferred" ] }, { "url": "https://git.kernel.org/stable/c/5f326fe2aef411a6575628f92bd861463ea91df7", "tags": [ "x_transferred" ] }, { "url": "https://git.kernel.org/stable/c/87cd1bbd6677411e17369cd4b7389ab1e1fdba44", "tags": [ "x_transferred" ] }, { "url": "https://git.kernel.org/stable/c/787468ee7a435777521d33399d012fd591ae2f94", "tags": [ "x_transferred" ] }, { "url": "https://git.kernel.org/stable/c/addd62a8cb6fa90aa322365c62487da61f6baab8", "tags": [ "x_transferred" ] }, { "url": "https://git.kernel.org/stable/c/b9208492fcaecff8f43915529ae34b3bcb03877c", "tags": [ "x_transferred" ] } ] }, { "metrics": [ { "other": { "type": "ssvc", "content": { "id": "CVE-2022-48786", "role": "CISA Coordinator", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "version": "2.0.3", "timestamp": "2024-09-10T16:59:52.125930Z" } } } ], "title": "CISA ADP Vulnrichment", "providerMetadata": { "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-11T17:34:16.278Z" } } ] } }