# CVE-2022-48839: linux: In the Linux kernel, the following vulnerability has been resolved:  net/packet: fix slab-out-of-bounds access in pac...

CVE-2022-48839 is fixed in linux on 1 platform, first by DEBIAN-CVE-2022-48839, released July 16, 2024. It is not reported as exploited. Patch Radar priority: Routine.

- Web page: https://patchblox.com/security/cve/CVE-2022-48839
- Priority: Routine
- CVSS: 5.5 (medium)
- EPSS: 0.0027
- CISA KEV: not listed
- Exploited (vendor report): no
- Publicly disclosed: no
- Published: Jul 16, 2024

## Description

In the Linux kernel, the following vulnerability has been resolved:  net/packet: fix slab-out-of-bounds access in packet_recvmsg()  syzbot found that when an AF_PACKET socket is using PACKET_COPY_THRESH and mmap operations, tpacket_rcv() is queueing skbs with garbage in skb->cb[], triggering a too big copy [1]  Presumably, users of af_packet using mmap() already gets correct metadata from the mapped buffer, we can simply make sure to clear 12 bytes that might be copied to user space later.  BUG: KASAN: stack-out-of-bounds in memcpy include/linux/fortify-string.h:225 [inline] BUG: KASAN: stack-out-of-bounds in packet_recvmsg+0x56c/0x1150 net/packet/af_packet.c:3489 Write of size 165 at addr ffffc9000385fb78 by task syz-executor233/3631  CPU: 0 PID: 3631 Comm: syz-executor233 Not tainted 5.17.0-rc7-syzkaller-02396-g0b3660695e80 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace:  <TASK>  __dump_stack lib/dump_stack.c:88 [inline]  dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106  print_address_description.constprop.0.cold+0xf/0x336 mm/kasan/report.c:255  __kasan_report mm/kasan/report.c:442 [inline]  kasan_report.cold+0x83/0xdf mm/kasan/report.c:459  check_region_inline mm/kasan/generic.c:183 [inline]  kasan_check_range+0x13d/0x180 mm/kasan/generic.c:189  memcpy+0x39/0x60 mm/kasan/shadow.c:66  memcpy include/linux/fortify-string.h:225 [inline]  packet_recvmsg+0x56c/0x1150 net/packet/af_packet.c:3489  sock_recvmsg_nosec net/socket.c:948 [inline]  sock_recvmsg net/socket.c:966 [inline]  sock_recvmsg net/socket.c:962 [inline]  ____sys_recvmsg+0x2c4/0x600 net/socket.c:2632  ___sys_recvmsg+0x127/0x200 net/socket.c:2674  __sys_recvmsg+0xe2/0x1a0 net/socket.c:2704  do_syscall_x64 arch/x86/entry/common.c:50 [inline]  do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80  entry_SYSCALL_64_after_hwframe+0x44/0xae RIP: 0033:0x7fdfd5954c29 Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 41 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007ffcf8e71e48 EFLAGS: 00000246 ORIG_RAX: 000000000000002f RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fdfd5954c29 RDX: 0000000000000000 RSI: 0000000020000500 RDI: 0000000000000005 RBP: 0000000000000000 R08: 000000000000000d R09: 000000000000000d R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffcf8e71e60 R13: 00000000000f4240 R14: 000000000000c1ff R15: 00007ffcf8e71e54  </TASK>  addr ffffc9000385fb78 is located in stack of task syz-executor233/3631 at offset 32 in frame:  ____sys_recvmsg+0x0/0x600 include/linux/uio.h:246  this frame has 1 object:  [32, 160) 'addr'  Memory state around the buggy address:  ffffc9000385fa80: 00 04 f3 f3 f3 f3 f3 00 00 00 00 00 00 00 00 00  ffffc9000385fb00: 00 00 00 00 00 00 00 00 00 00 00 f1 f1 f1 f1 00 >ffffc9000385fb80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f3                                                                 ^  ffffc9000385fc00: f3 f3 f3 00 00 00 00 00 00 00 00 00 00 00 00 f1  ffffc9000385fc80: f1 f1 f1 00 f2 f2 f2 00 f2 f2 f2 00 00 00 00 00 ==================================================================

## Where it's fixed

| Platform | Product | Fixed in | Fix | Released |
|---|---|---|---|---|
| Linux | linux Debian 12.15 (bookworm) | 5.17.3-1 | [DEBIAN-CVE-2022-48839](https://patchblox.com/security/data/fix/linux/debian-cve-2022-48839.md) | Jul 16, 2024 |
| Linux | linux Debian 13.5 (trixie) | 5.17.3-1 | [DEBIAN-CVE-2022-48839](https://patchblox.com/security/data/fix/linux/debian-cve-2022-48839.md) | Jul 16, 2024 |
| Linux | linux Debian 14 | 5.17.3-1 | [DEBIAN-CVE-2022-48839](https://patchblox.com/security/data/fix/linux/debian-cve-2022-48839.md) | Jul 16, 2024 |

---

Data as of 2026-11-08T00:53:09Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.