7.1

CVE-2022-48757: net: fix information leakage in /proc/net/ptype

Analyzed
AliasesUBUNTU-CVE-2022-48757DEBIAN-CVE-2022-48757
Published 20-06-2024Last modified 11-05-2026

Vulnerability summary

CVE-2022-48757 is a high (CVSS 7.1) Exposure of Resource to Wrong Sphere vulnerability in linux. EPSS estimates a 0.22% chance of exploitation in the next 30 days, higher than 12.8% of scored vulnerabilities.

Priority
Routine

Not severe (CVSS 7.1, local access); no exploitation reported by the 5 checked sources

Source freshness unavailable

How is this decided?
CVSS score
7.1/10
010
High · v3.1 (NVD)
EPSS score
0.22%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 3
RHSA-2024:5101RHSA-2024:5102RHSA-2024:6206

Timeline

  1. 20-06-2024
    PublishedVulnerability first disclosed.
  2. 11-05-2026
    Last modifiedVulnerability information updated.

Description

In the Linux kernel, the following vulnerability has been resolved: net: fix information leakage in /proc/net/ptype In one net namespace, after creating a packet socket without binding it to a device, users in other net namespaces can observe the new `packet_type` added by this packet socket by reading `/proc/net/ptype` file. This is minor information leakage as packet socket is namespace aware. Add a net pointer in `packet_type` to keep the net namespace of of corresponding packet socket. In `ptype_seq_show`, this net pointer must be checked when it is not NULL.

CVSS metrics

3 scores · 3 sources · 1 version

EPSS trend

Probability

0.22%

Chance of exploitation in the next 30 days

Percentile

13%

Versus all other CVEs

30-day change

No change 0.00 pp

From 0.22% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs
CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Version check

Known conditions: local access, low-privilege account, no user interaction (CVSS vector). Other conditions: not stated in public data.

Ubuntu89 products
  • linuxAll versions (No fix recorded) | < 4.15.0-176.185 | < 5.4.0-109.123
  • linux-allwinner-5.19All versions (No fix recorded)
  • linux-awsAll versions (No fix recorded) | < 4.15.0-1127.136 | < 5.4.0-1072.77
  • linux-aws-5.0All versions (No fix recorded)
  • linux-aws-5.11All versions (No fix recorded)
Linux2 products
  • linux≥ 2feb27dbe00cbb4f7d31f90acf6bd0d751dd0a50, < 8f88c78d24f6f346919007cd459fd7e51a8c7779 | ≥ 2feb27dbe00cbb4f7d31f90acf6bd0d751dd0a50, < be1ca30331c7923c6f376610c1bd6059be9b1908 | ≥ 2feb27dbe00cbb4f7d31f90acf6bd0d751dd0a50, < c38023032a598ec6263e008d62c7f02def72d5c7 | ≥ 2feb27dbe00cbb4f7d31f90acf6bd0d751dd0a50, < b67ad6170c0ea87391bb253f35d1f78857736e54 | ≥ 2feb27dbe00cbb4f7d31f90acf6bd0d751dd0a50, < e372ecd455b6ebc7720f52bf4b5f5d44d02f2092 | ≥ 2feb27dbe00cbb4f7d31f90acf6bd0d751dd0a50, < db044d97460ea792110eb8b971e82569ded536c6 | ≥ 2feb27dbe00cbb4f7d31f90acf6bd0d751dd0a50, < e43669c77cb3a742b7d84ecdc7c68c4167a7709b | ≥ 2feb27dbe00cbb4f7d31f90acf6bd0d751dd0a50, < 839ec7039513a4f84bfbaff953a9393471176bee | ≥ 2feb27dbe00cbb4f7d31f90acf6bd0d751dd0a50, < 47934e06b65637c88a762d9c98329ae6e3238888 | 2.6.26
  • linux_kernel≥ 2.6.26, < 4.4.302 | ≥ 4.5, < 4.9.300 | ≥ 4.10, < 4.14.265 | ≥ 4.15, < 4.19.228 | ≥ 4.20, < 5.4.176 | ≥ 5.5, < 5.10.96 | ≥ 5.11, < 5.15.19 | ≥ 5.16, < 5.16.5 | 5.17:rc1
Debian1 product
  • linux< 5.16.7-1

3 vendors · 92 products

References

13 links
Show all 13 references