Vulnerability in Linux

CVE-2022-48949

In the Linux kernel, the following vulnerability has been resolved: igb: Initialize mailbox message for VF reset When a MAC address is not assigned to the VF, that portion of the message sent to the VF is not set. The memory, however, is allocated from the stack meaning that information may be leaked to the VM. Initialize the message buffer to 0 so that no information is passed to the VM in this case.

Published · last modified .

CVSS v3 metric

CVSS v3 base score 5.5 (Medium). Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N.

EPSS exploit prediction

EPSS: 0.003 (15.0th percentile), scored .

Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 15th percentile — 15.0% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS trend (30 days)EPSS over the last 30 days for CVE-2022-48949: held from 0.003 to 0.003.

EPSS over last 30 days · oldest: 0.003 · newest: 0.003 · change: 0.000

Affected products

  • Linux — versions 6ddbc4cf1f4d5a3a58b4223c80881f299dae3774, 4.0, 0
  • Linux Kernel — versions 6.1, 6.1.1

Weakness classification (CWE)

References

Frequently asked questions

What is CVE-2022-48949?
CVE-2022-48949 is a medium-severity vulnerability in Linux, classified under Use of Uninitialized Resource. CVSS score: 5.5/10. Published 2024-10-21.
How severe is CVE-2022-48949?
Medium severity. CVSS v3 base score is 5.5 out of 10.