CVE-2022-48757

net: fix information leakage in /proc/net/ptype

published June 20, 2024

CVSS
—
EPSS
0%
Percentile
12.1
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

net: fix information leakage in /proc/net/ptype

In one net namespace, after creating a packet socket without binding

it to a device, users in other net namespaces can observe the new

`packet_type` added by this packet socket by reading `/proc/net/ptype`

file. This is minor information leakage as packet socket is

namespace aware.

Add a net pointer in `packet_type` to keep the net namespace of

of corresponding packet socket. In `ptype_seq_show`, this net pointer

must be checked when it is not NULL.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00222 · 12.1th percentile
Published
2024-06-20T11:13Z
EPSS history
Timeline
  • 20 JUN 11:13Z
    net: fix information leakage in /proc/net/ptype
    cvelistv5