Go to homepageCyberStrike

Menu

Star on GitHub · 3.4k
Sign inDownload

CVE-2022-48659

5.5 · MEDIUM

In the Linux kernel, the following vulnerability has been resolved: mm/slub: fix to return errno if kmalloc() fails In create_unique_id(), kmalloc(, GFP_KERNEL) can fail due to out-of-memory, if…

Published Apr 28, 2024EPSS 0.24%

Overview

CVE-2022-48659 is a medium-severity vulnerability. It was published on April 28, 2024 and has a CVSS 3.1 base score of 5.5 (MEDIUM).

This vulnerability has a CVSS 3.1 base score of 5.5, rated MEDIUM. It requires local or adjacent network access to exploit. Some level of privileges is required for exploitation.

Technical description

In the Linux kernel, the following vulnerability has been resolved:

mm/slub: fix to return errno if kmalloc() fails

In create_unique_id(), kmalloc(, GFP_KERNEL) can fail due to

out-of-memory, if it fails, return errno correctly rather than

triggering panic via BUG_ON();

kernel BUG at mm/slub.c:5893!

Internal error: Oops - BUG: 0 [#1] PREEMPT SMP

Call trace:

sysfs_slab_add+0x258/0x260 mm/slub.c:5973

__kmem_cache_create+0x60/0x118 mm/slub.c:4899

create_cache mm/slab_common.c:229 [inline]

kmem_cache_create_usercopy+0x19c/0x31c mm/slab_common.c:335

kmem_cache_create+0x1c/0x28 mm/slab_common.c:390

f2fs_kmem_cache_create fs/f2fs/f2fs.h:2766 [inline]

f2fs_init_xattr_caches+0x78/0xb4 fs/f2fs/xattr.c:808

f2fs_fill_super+0x1050/0x1e0c fs/f2fs/super.c:4149

mount_bdev+0x1b8/0x210 fs/super.c:1400

f2fs_mount+0x44/0x58 fs/f2fs/super.c:4512

legacy_get_tree+0x30/0x74 fs/fs_context.c:610

vfs_get_tree+0x40/0x140 fs/super.c:1530

do_new_mount+0x1dc/0x4e4 fs/namespace.c:3040

path_mount+0x3

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References

Refgit.kernel.org/stable/c/016b150992eebc32c4a18f783cf2bb6e2545a3d9Refgit.kernel.org/stable/c/02bcd951aa3c2cea95fb241c20802e9501940296Refgit.kernel.org/stable/c/2d6e55e0c03804e1e227b80a5746e086d6c6696cRefgit.kernel.org/stable/c/379ac7905ff3f0a6a4e507d3e9f710ec4fab9124Refgit.kernel.org/stable/c/7e9c323c52b379d261a72dc7bd38120a761a93cdRefgit.kernel.org/stable/c/a1d83a19cec3bfeb2b3547a1f7631e432a766d1cRefgit.kernel.org/stable/c/e9219fa63c5c25804af82c7aa54d1ec770ebe457Refgit.kernel.org/stable/c/e996821717c5cf8aa1e1abdb6b3d900a231e3755Refgit.kernel.org/stable/c/016b150992eebc32c4a18f783cf2bb6e2545a3d9Refgit.kernel.org/stable/c/02bcd951aa3c2cea95fb241c20802e9501940296

How CyberStrike helps

Frequently asked questions

What is CVE-2022-48659?

CVE-2022-48659 is a medium-severity vulnerability. It was published on April 28, 2024 and has a CVSS 3.1 base score of 5.5 (MEDIUM).

How severe is CVE-2022-48659?

This vulnerability has a CVSS 3.1 base score of 5.5, rated MEDIUM. It requires local or adjacent network access to exploit. Some level of privileges is required for exploitation.

How do I fix or remediate CVE-2022-48659?

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

How can CyberStrike help with CVE-2022-48659?

CyberStrike is an open-source, AI-augmented pentesting engine. Rather than flag a version number, it tests whether an issue like CVE-2022-48659 is actually reachable in your own applications and APIs, then verifies each finding before reporting it. That tells you if the weakness is a real, exploitable risk in your environment or a false positive you can safely deprioritize.

Related MEDIUM CVEs from 2022

View all
Browse by year2026202520242023202220212020201920182017201620152014201320122011201020092008200720062005200420032002200120001999
Watch the demo →