NetSight
IP …
high7.1

CVE-2022-48757

In the Linux kernel, the following vulnerability has been resolved: net: fix information leakage in /proc/net/ptype In one net namespace, after creating a pack…

Impact

In the Linux kernel, the following vulnerability has been resolved: net: fix information leakage in /proc/net/ptype In one net namespace, after creating a packet socket without binding it to a device, users in other net namespaces can observe the new `packet_type` added by this packet socket by reading `/proc/net/ptype` file. This is minor information leakage as packet socket is namespace aware. Add a net pointer in `packet_type` to keep the net namespace of of corresponding packet socket. In `ptype_seq_show`, this net pointer must be checked when it is not NULL.

Affected products

VendorProductAffected versions
LinuxLinux Kernel
from 2.6.26 before 4.4.302
from 4.5 before 4.9.300
from 4.10 before 4.14.265
from 4.15 before 4.19.228
from 4.20 before 5.4.176
from 5.5 before 5.10.96

Weakness classification

CWE-668

References