{
  "cveId": "CVE-2022-49017",
  "url": "https://patchblox.com/security/cve/CVE-2022-49017",
  "summary": "CVE-2022-49017 is fixed in linux on 1 platform, first by DEBIAN-CVE-2022-49017, released October 21, 2024. It is not reported as exploited. Patch Radar priority: High.",
  "title": "linux: In the Linux kernel, the following vulnerability has been resolved:  tipc: re-fetch skb cb after tipc_msg_validate  A...",
  "description": "In the Linux kernel, the following vulnerability has been resolved:  tipc: re-fetch skb cb after tipc_msg_validate  As the call trace shows, the original skb was freed in tipc_msg_validate(), and dereferencing the old skb cb would cause an use-after-free crash.    BUG: KASAN: use-after-free in tipc_crypto_rcv_complete\u002B0x1835/0x2240 [tipc]   Call Trace:    \u003CIRQ\u003E    tipc_crypto_rcv_complete\u002B0x1835/0x2240 [tipc]    tipc_crypto_rcv\u002B0xd32/0x1ec0 [tipc]    tipc_rcv\u002B0x744/0x1150 [tipc]   ...   Allocated by task 47078:    kmem_cache_alloc_node\u002B0x158/0x4d0    __alloc_skb\u002B0x1c1/0x270    tipc_buf_acquire\u002B0x1e/0xe0 [tipc]    tipc_msg_create\u002B0x33/0x1c0 [tipc]    tipc_link_build_proto_msg\u002B0x38a/0x2100 [tipc]    tipc_link_timeout\u002B0x8b8/0xef0 [tipc]    tipc_node_timeout\u002B0x2a1/0x960 [tipc]    call_timer_fn\u002B0x2d/0x1c0   ...   Freed by task 47078:    tipc_msg_validate\u002B0x7b/0x440 [tipc]    tipc_crypto_rcv_complete\u002B0x4b5/0x2240 [tipc]    tipc_crypto_rcv\u002B0xd32/0x1ec0 [tipc]    tipc_rcv\u002B0x744/0x1150 [tipc]  This patch fixes it by re-fetching the skb cb from the new allocated skb after calling tipc_msg_validate().",
  "published": "2024-10-21T20:15:12Z",
  "severity": "high",
  "cvss": 7.8,
  "cvssVector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
  "epss": 0.00642,
  "epssPercentile": 0.51004,
  "priority": "High",
  "priorityTier": 3,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 12.15 (bookworm)",
      "fixedVersion": "6.0.12-1",
      "fix": "DEBIAN-CVE-2022-49017",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2022-49017",
      "released": "2024-10-21T20:15:12Z"
    },
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 13.5 (trixie)",
      "fixedVersion": "6.0.12-1",
      "fix": "DEBIAN-CVE-2022-49017",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2022-49017",
      "released": "2024-10-21T20:15:12Z"
    },
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 14",
      "fixedVersion": "6.0.12-1",
      "fix": "DEBIAN-CVE-2022-49017",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2022-49017",
      "released": "2024-10-21T20:15:12Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-08T00:53:09Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}