CVE-2022-49561
Estado: ModificadaMedia (5.5)—
In the Linux kernel, the following vulnerability has been resolved:
netfilter: conntrack: re-fetch conntrack after insertion
In case the conntrack is clashing, insertion can free skb->_nfct and set skb->_nfct to the already-confirmed entry.
This wasn't found before because the conntrack entry and the extension space used to free'd after an rcu grace period, plus the race needs events enabled to trigger.
CVSS
- Versión: 3.1
- Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
- Puntuación base: 5.5
Probabilidad de explotación (EPSS)
- Probabilidad de explotación en los próximos 30 días: 0.82%
- Percentil entre todas las CVEs puntuadas: 56
- Fecha de la puntuación: 6/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
Tecnologías afectadas (1)
CWE
- NVD-CWE-noinfo
Referencias
- https://git.kernel.org/stable/c/01989d7eebb61c99bd4b88ebc8e261bd2f02caed
- https://git.kernel.org/stable/c/04e4a11dc723c52db7a36dc58f0d69ce6426f8f0
- https://git.kernel.org/stable/c/04f9e9104c969d8ce10a4a43634f641ed082092d
- https://git.kernel.org/stable/c/56b14ecec97f39118bf85c9ac2438c5a949509ed
- https://git.kernel.org/stable/c/91a36ec160ec1a0c8f5352b772dffcbb0b6023e3
- https://git.kernel.org/stable/c/92a999d1963eed0df666284e20055136ceabd12f
- https://git.kernel.org/stable/c/b16bb373988da3ceb0308381634117e18b6ec60d
- https://git.kernel.org/stable/c/e97222b785e70e8973281666d709baad6523d8af
JSON original (NVD)
Mostrar
{
"id": "CVE-2022-49561",
"cveTags": [],
"metrics": {
"cvssMetricV31": [
{
"type": "Secondary",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"cvssData": {
"scope": "UNCHANGED",
"version": "3.1",
"baseScore": 9.8,
"attackVector": "NETWORK",
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"integrityImpact": "HIGH",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"availabilityImpact": "HIGH",
"privilegesRequired": "NONE",
"confidentialityImpact": "HIGH"
},
"impactScore": 5.9,
"exploitabilityScore": 3.9
},
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"scope": "UNCHANGED",
"version": "3.1",
"baseScore": 5.5,
"attackVector": "LOCAL",
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"integrityImpact": "NONE",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"availabilityImpact": "HIGH",
"privilegesRequired": "LOW",
"confidentialityImpact": "NONE"
},
"impactScore": 3.6,
"exploitabilityScore": 1.8
}
]
},
"affected": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"affectedData": [
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "71d8c47fc653711c41bc3282e5b0e605b3727956",
"lessThan": "e97222b785e70e8973281666d709baad6523d8af",
"versionType": "git"
},
{
"status": "affected",
"version": "71d8c47fc653711c41bc3282e5b0e605b3727956",
"lessThan": "92a999d1963eed0df666284e20055136ceabd12f",
"versionType": "git"
},
{
"status": "affected",
"version": "71d8c47fc653711c41bc3282e5b0e605b3727956",
"lessThan": "b16bb373988da3ceb0308381634117e18b6ec60d",
"versionType": "git"
},
{
"status": "affected",
"version": "71d8c47fc653711c41bc3282e5b0e605b3727956",
"lessThan": "91a36ec160ec1a0c8f5352b772dffcbb0b6023e3",
"versionType": "git"
},
{
"status": "affected",
"version": "71d8c47fc653711c41bc3282e5b0e605b3727956",
"lessThan": "01989d7eebb61c99bd4b88ebc8e261bd2f02caed",
"versionType": "git"
},
{
"status": "affected",
"version": "71d8c47fc653711c41bc3282e5b0e605b3727956",
"lessThan": "04f9e9104c969d8ce10a4a43634f641ed082092d",
"versionType": "git"
},
{
"status": "affected",
"version": "71d8c47fc653711c41bc3282e5b0e605b3727956",
"lessThan": "04e4a11dc723c52db7a36dc58f0d69ce6426f8f0",
"versionType": "git"
},
{
"status": "affected",
"version": "71d8c47fc653711c41bc3282e5b0e605b3727956",
"lessThan": "56b14ecec97f39118bf85c9ac2438c5a949509ed",
"versionType": "git"
}
],
"programFiles": [
"include/net/netfilter/nf_conntrack_core.h"
],
"defaultStatus": "unaffected"
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "4.7"
},
{
"status": "unaffected",
"version": "0",
"lessThan": "4.7",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "4.14.282",
"versionType": "semver",
"lessThanOrEqual": "4.14.*"
},
{
"status": "unaffected",
"version": "4.19.246",
"versionType": "semver",
"lessThanOrEqual": "4.19.*"
},
{
"status": "unaffected",
"version": "5.4.197",
"versionType": "semver",
"lessThanOrEqual": "5.4.*"
},
{
"status": "unaffected",
"version": "5.10.120",
"versionType": "semver",
"lessThanOrEqual": "5.10.*"
},
{
"status": "unaffected",
"version": "5.15.45",
"versionType": "semver",
"lessThanOrEqual": "5.15.*"
},
{
"status": "unaffected",
"version": "5.17.13",
"versionType": "semver",
"lessThanOrEqual": "5.17.*"
},
{
"status": "unaffected",
"version": "5.18.2",
"versionType": "semver",
"lessThanOrEqual": "5.18.*"
},
{
"status": "unaffected",
"version": "5.19",
"versionType": "original_commit_for_fix",
"lessThanOrEqual": "*"
}
],
"programFiles": [
"include/net/netfilter/nf_conntrack_core.h"
],
"defaultStatus": "affected"
}
]
}
],
"published": "2025-02-26T07:01:31.877",
"references": [
{
"url": "https://git.kernel.org/stable/c/01989d7eebb61c99bd4b88ebc8e261bd2f02caed",
"tags": [
"Patch"
],
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/04e4a11dc723c52db7a36dc58f0d69ce6426f8f0",
"tags": [
"Patch"
],
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/04f9e9104c969d8ce10a4a43634f641ed082092d",
"tags": [
"Patch"
],
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/56b14ecec97f39118bf85c9ac2438c5a949509ed",
"tags": [
"Patch"
],
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/91a36ec160ec1a0c8f5352b772dffcbb0b6023e3",
"tags": [
"Patch"
],
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/92a999d1963eed0df666284e20055136ceabd12f",
"tags": [
"Patch"
],
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/b16bb373988da3ceb0308381634117e18b6ec60d",
"tags": [
"Patch"
],
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/e97222b785e70e8973281666d709baad6523d8af",
"tags": [
"Patch"
],
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
],
"vulnStatus": "Modified",
"weaknesses": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"description": [
{
"lang": "en",
"value": "NVD-CWE-noinfo"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: conntrack: re-fetch conntrack after insertion\n\nIn case the conntrack is clashing, insertion can free skb->_nfct and\nset skb->_nfct to the already-confirmed entry.\n\nThis wasn't found before because the conntrack entry and the extension\nspace used to free'd after an rcu grace period, plus the race needs\nevents enabled to trigger."
},
{
"lang": "es",
"value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: netfilter: conntrack: volver a obtener conntrack después de la inserción En caso de que conntrack esté en conflicto, la inserción puede liberar skb->_nfct y establecer skb->_nfct en la entrada ya confirmada. Esto no se encontró antes porque la entrada conntrack y el espacio de extensión solían liberarse después de un período de gracia de rcu, además de que la ejecución necesita eventos habilitados para activarse."
}
],
"lastModified": "2026-08-04T10:17:51.783",
"configurations": [
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "897D9E70-5BA4-4E88-B774-C6A3B6B853EF",
"versionEndExcluding": "4.14.282",
"versionStartIncluding": "4.7"
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "FEDF30DC-BB12-4C4C-A134-AA5D59D73C0C",
"versionEndExcluding": "4.19.246",
"versionStartIncluding": "4.15"
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "F7FDD830-741D-44F7-A537-13755A4314DE",
"versionEndExcluding": "5.4.197",
"versionStartIncluding": "4.20"
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "92818976-ECCC-4744-9287-E2CF4B2C4131",
"versionEndExcluding": "5.10.120",
"versionStartIncluding": "5.5"
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "08D699AD-F4CE-4BDD-A97E-4997299C7712",
"versionEndExcluding": "5.15.45",
"versionStartIncluding": "5.11"
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "192FC54B-5367-49D6-B410-0285F14665B1",
"versionEndExcluding": "5.17.13",
"versionStartIncluding": "5.16"
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "9FF255A1-64F4-4E31-AF44-C92FB8773BA2",
"versionEndExcluding": "5.18.2",
"versionStartIncluding": "5.18"
}
],
"operator": "OR"
}
]
}
],
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}