CVE-2022-49770

Estado: ModificadaAlta (7.8)—

In the Linux kernel, the following vulnerability has been resolved:

ceph: avoid putting the realm twice when decoding snaps fails

When decoding the snaps fails it maybe leaving the 'first_realm' and 'realm' pointing to the same snaprealm memory. And then it'll put it twice and could cause random use-after-free, BUG_ON, etc issues.

CVSS

Versión: 3.1
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Puntuación base: 7.8

Probabilidad de explotación (EPSS)

Probabilidad de explotación en los próximos 30 días: 0.57%
Percentil entre todas las CVEs puntuadas: 45
Fecha de la puntuación: 6/10/2026

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

ExplotaciónT1068 Exploitation for Privilege Escalationprivilege escalation85 %
Impacto principalT1059 Command and Scripting Interpreterexecution75 %

AV:L/PR:L sin UI:N indica escalada de privilegios local. CWE-416 (use-after-free) en kernel Linux puede ejecutar código. La falla en decodificación de snaprealm permite lectura/escritura de memoria de kernel.

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Execution Prevention Threat Intelligence Program Restrict Web-Based Content Privileged Account Management Limit Software Installation Behavior Prevention on Endpoint

Tecnologías afectadas (1)

Linux — Linux Kernel

CWE

CWE-416

Referencias

JSON original (NVD)

Mostrar

{
  "id": "CVE-2022-49770",
  "cveTags": [],
  "metrics": {
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 9.8,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 3.9
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.8,
          "attackVector": "LOCAL",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 1.8
      }
    ]
  },
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "982d6011bc30a26e8a3d546e0e7fc7db2c255d85",
              "lessThan": "274e4c79a3a2a24fba7cfe0e41113f1138785c37",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "982d6011bc30a26e8a3d546e0e7fc7db2c255d85",
              "lessThan": "cb7495fe957526555782ce0723f79ce92a6db22e",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "982d6011bc30a26e8a3d546e0e7fc7db2c255d85",
              "lessThan": "044bc6d3c2c0e9090b0841e7b723875756534b45",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "982d6011bc30a26e8a3d546e0e7fc7db2c255d85",
              "lessThan": "2f6e2de3a5289004650118b61f138fe7c28e1905",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "982d6011bc30a26e8a3d546e0e7fc7db2c255d85",
              "lessThan": "fd879c83e87735ab8f00ef7755752cf0cbae24b2",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "982d6011bc30a26e8a3d546e0e7fc7db2c255d85",
              "lessThan": "51884d153f7ec85e18d607b2467820a90e0f4359",
              "versionType": "git"
            }
          ],
          "programFiles": [
            "fs/ceph/snap.c"
          ],
          "defaultStatus": "unaffected"
        },
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.0"
            },
            {
              "status": "unaffected",
              "version": "0",
              "lessThan": "4.0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "4.19.268",
              "versionType": "semver",
              "lessThanOrEqual": "4.19.*"
            },
            {
              "status": "unaffected",
              "version": "5.4.226",
              "versionType": "semver",
              "lessThanOrEqual": "5.4.*"
            },
            {
              "status": "unaffected",
              "version": "5.10.157",
              "versionType": "semver",
              "lessThanOrEqual": "5.10.*"
            },
            {
              "status": "unaffected",
              "version": "5.15.81",
              "versionType": "semver",
              "lessThanOrEqual": "5.15.*"
            },
            {
              "status": "unaffected",
              "version": "6.0.10",
              "versionType": "semver",
              "lessThanOrEqual": "6.0.*"
            },
            {
              "status": "unaffected",
              "version": "6.1",
              "versionType": "original_commit_for_fix",
              "lessThanOrEqual": "*"
            }
          ],
          "programFiles": [
            "fs/ceph/snap.c"
          ],
          "defaultStatus": "affected"
        }
      ]
    }
  ],
  "published": "2025-05-01T15:15:59.920",
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/044bc6d3c2c0e9090b0841e7b723875756534b45",
      "tags": [
        "Patch"
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/274e4c79a3a2a24fba7cfe0e41113f1138785c37",
      "tags": [
        "Patch"
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/2f6e2de3a5289004650118b61f138fe7c28e1905",
      "tags": [
        "Patch"
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/51884d153f7ec85e18d607b2467820a90e0f4359",
      "tags": [
        "Patch"
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/cb7495fe957526555782ce0723f79ce92a6db22e",
      "tags": [
        "Patch"
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/fd879c83e87735ab8f00ef7755752cf0cbae24b2",
      "tags": [
        "Patch"
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-416"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nceph: avoid putting the realm twice when decoding snaps fails\n\nWhen decoding the snaps fails it maybe leaving the 'first_realm'\nand 'realm' pointing to the same snaprealm memory. And then it'll\nput it twice and could cause random use-after-free, BUG_ON, etc\nissues."
    },
    {
      "lang": "es",
      "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: ceph: evita repetir el dominio cuando falla la decodificación de snaps. Al fallar la decodificación de snaps, puede que \"first_realm\" y \"realm\" apunten a la misma memoria de snaprealm. En ese caso, lo repetirá, lo que podría causar problemas aleatorios de use-after-free, BUG_ON, etc."
    }
  ],
  "lastModified": "2026-08-15T13:17:28.167",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "0EDF5BF7-F16B-4246-879A-2952C0D0140F",
              "versionEndExcluding": "4.19.268",
              "versionStartIncluding": "2.6.35"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "274F5087-5805-4D03-8C74-8517300658F1",
              "versionEndExcluding": "5.4.226",
              "versionStartIncluding": "4.20"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5EAF291E-0C2B-409D-9D82-59F0C0B67CAB",
              "versionEndExcluding": "5.10.157",
              "versionStartIncluding": "5.5"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "899FBA32-27B2-4660-BC94-C43ED4349EB5",
              "versionEndExcluding": "5.15.81",
              "versionStartIncluding": "5.11"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "64F9ADD1-3ADB-4D66-A00F-4A83010B05F0",
              "versionEndExcluding": "6.0.10",
              "versionStartIncluding": "5.16"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:2.6.34:-:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A3B1BC1D-ED46-4364-A1D9-1FA74182B03A"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:2.6.34:rc2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "86D3F64C-3F27-43E0-B0D4-62CE1E1F4EFB"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:2.6.34:rc3:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "7927713B-5EB0-41EB-86A9-9935775162E0"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:2.6.34:rc4:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "59037296-3143-4FBB-AFF7-D4FE2C85502F"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:2.6.34:rc5:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "9CA27FD5-7DBF-4C85-80A9-D523B2E4B033"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:2.6.34:rc6:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "9711E333-A8E7-4F4B-BCFD-2023E889651A"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:2.6.34:rc7:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E04D3358-973B-42A1-8E08-2E3AE947193C"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:6.1:rc1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E7E331DA-1FB0-4DEC-91AC-7DA69D461C11"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:6.1:rc2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "17F0B248-42CF-4AE6-A469-BB1BAE7F4705"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:6.1:rc3:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E2422816-0C14-4B5E-A1E6-A9D776E5C49B"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:6.1:rc4:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1C6E00FE-5FB9-4D20-A1A1-5A32128F9B76"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:6.1:rc5:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "35B26BE4-43A6-4A36-A7F6-5B3F572D9186"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}