{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2022-49182", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2025-02-26T01:49:39.283Z", "datePublished": "2025-02-26T01:55:33.574Z", "dateUpdated": "2026-08-05T08:54:19.865Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T08:54:19.865Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: hns3: add vlan list lock to protect vlan list\n\nWhen adding port base VLAN, vf VLAN need to remove from HW and modify\nthe vlan state in vf VLAN list as false. If the periodicity task is\nfreeing the same node, it may cause \"use after free\" error.\nThis patch adds a vlan list lock to protect the vlan list." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:L - The bug is in the hns3 PF driver's vlan_list handling, reached via local rtnetlink/netdev ops (ndo_set_vf_vlan, ndo_vlan_rx_add/kill_vid) or VF mailbox processing on the host—not via remote packet parsing or network-facing protocol servers.\nAC:L - An attacker who can drive VLAN/port-base-VLAN configuration controls the rtnl-side list mutate/free paths and can arm vlan_del_fail_bmap (VLAN kill during reset) so the periodic service task frees the same nodes; both sides of the race are attacker-influenced, so complexity is Low.\nPR:L - Entry requires CAP_NET_ADMIN in the netns that owns the hns3 PF/VF, and in the worst reasonable deployment (device/VF delegated into a user or container netns on Kunpeng/SR-IOV hosts) that capability is available via user namespaces without real init-namespace root.\nUI:N - The attacker triggers the race directly through their own VLAN and VF configuration operations; no separate victim action is required.\nS:U - Corruption is confined to the host kernel's hns3 PF vlan_list objects within the same OS security authority; this is standard local kernel memory corruption, not a VM/IOMMU boundary escape as the primary scored scenario.\nC:H - The race is a heap use-after-free of kzalloc'd hclge_vport_vlan_cfg list nodes; UAF enables reclaim/spray and arbitrary kernel read primitives under the higher-severity rule.\nI:H - The same freed list-node UAF provides a heap write/control-flow hijack primitive typical of kernel slab use-after-free exploitation.\nA:H - Concurrent list walk versus list_del/kfree causes kernel oops/panic (and KASAN use-after-free), which is full availability impact and can be retried." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c", "drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.h" ], "versions": [ { "version": "c6075b193462d9a3930fb41f587f94720658752a", "lessThan": "30f0ff7176efe8ac6c55f85bce26ed58bb608758", "status": "affected", "versionType": "git" }, { "version": "c6075b193462d9a3930fb41f587f94720658752a", "lessThan": "09e383ca97e798f9954189b741af54b5c51e7a97", "status": "affected", "versionType": "git" }, { "version": "c6075b193462d9a3930fb41f587f94720658752a", "lessThan": "f58af41deeab0f45c9c80adf5f2de489ebbac3dd", "status": "affected", "versionType": "git" }, { "version": "c6075b193462d9a3930fb41f587f94720658752a", "lessThan": "1932a624ab88ff407d1a1d567fe581faa15dc725", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c", "drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.h" ], "versions": [ { "version": "5.1", "status": "affected" }, { "version": "0", "lessThan": "5.1", "status": "unaffected", "versionType": "semver" }, { "version": "5.15.33", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.16.19", "lessThanOrEqual": "5.16.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.17.2", "lessThanOrEqual": "5.17.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.18", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.1", "versionEndExcluding": "5.15.33" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.1", "versionEndExcluding": "5.16.19" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.1", "versionEndExcluding": "5.17.2" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.1", "versionEndExcluding": "5.18" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/30f0ff7176efe8ac6c55f85bce26ed58bb608758" }, { "url": "https://git.kernel.org/stable/c/09e383ca97e798f9954189b741af54b5c51e7a97" }, { "url": "https://git.kernel.org/stable/c/f58af41deeab0f45c9c80adf5f2de489ebbac3dd" }, { "url": "https://git.kernel.org/stable/c/1932a624ab88ff407d1a1d567fe581faa15dc725" } ], "title": "net: hns3: add vlan list lock to protect vlan list", "x_generator": { "engine": "bippy-1.2.0" } }, "adp": [ { "metrics": [ { "cvssV3_1": { "scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH" } }, { "other": { "type": "ssvc", "content": { "id": "CVE-2022-49182", "role": "CISA Coordinator", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "total" } ], "version": "2.0.3", "timestamp": "2025-03-04T18:04:19.985508Z" } } } ], "problemTypes": [ { "descriptions": [ { "lang": "en", "type": "CWE", "cweId": "CWE-416", "description": "CWE-416 Use After Free" } ] } ], "title": "CISA ADP Vulnrichment", "providerMetadata": { "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-03-04T18:07:17.957Z" } } ] } }