CVE-2022-49766

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2022-49766
In the Linux kernel, the following vulnerability has been resolved: netlink: Bounds-check struct nlmsgerr creation In preparation for FORTIFY_SOURCE doing bounds-check on memcpy(), switch from __nlmsg_put to nlmsg_put(), and explain the bounds check for dealing with the memcpy() across a composite flexible array struct. Avoids this future run-time warning: memcpy: detected field-spanning write (size 32) of single field "&errmsg->msg" at net/netlink/af_netlink.c:2447 (size 16)

5.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/710d21fdff9a98d621cd4e64167f3ef8af4e2fd1 Patch
https://git.kernel.org/stable/c/aff4eb16f589c3af322a2582044bca365381fcd6 Patch
Configurations

Configuration 1 (hide)

cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
History

06 Nov 2025, 21:57

Type Values Removed Values Added
First Time Linux
Linux linux Kernel
CWE NVD-CWE-noinfo
CPE cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
References () https://git.kernel.org/stable/c/710d21fdff9a98d621cd4e64167f3ef8af4e2fd1 - () https://git.kernel.org/stable/c/710d21fdff9a98d621cd4e64167f3ef8af4e2fd1 - Patch
References () https://git.kernel.org/stable/c/aff4eb16f589c3af322a2582044bca365381fcd6 - () https://git.kernel.org/stable/c/aff4eb16f589c3af322a2582044bca365381fcd6 - Patch
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.5
Summary
  • (es) En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: netlink: Creación de la estructura nlmsgerr con comprobación de los límites. En preparación para que FORTIFY_SOURCE realice la comprobación de los límites en memcpy(), cambie de __nlmsg_put a nlmsg_put() y explique la comprobación de los límites para procesar memcpy() en una estructura de matriz flexible compuesta. Esto evita esta futura advertencia en tiempo de ejecución: memcpy: se detectó una escritura que abarca campos (tamaño 32) en un solo campo "&errmsg->msg" en net/netlink/af_netlink.c:2447 (tamaño 16).

01 May 2025, 15:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-05-01 15:15

Updated : 2025-11-06 21:57

NVD link : CVE-2022-49766

Mitre link : CVE-2022-49766

CVE.ORG link : CVE-2022-49766

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
NVD-CWE-noinfo