CVE-2022-36946

Published: Jul 27, 2022Modified: Oct 14, 2026

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Exploitability: 3.9 / Impact: 3.6

Source: NVD

Description

nfqnl_mangle in net/netfilter/nfnetlink_queue.c in the Linux kernel through 5.18.14 allows remote attackers to cause a denial of service (panic) because, in the case of an nf_queue verdict with a one-byte nfta_payload attribute, an skb_pull can encounter a negative skb->len.

Affected (14)

Products: Linux: Linux Kernel · Debian: Debian Linux · Netapp: Active Iq Unified Manager, Hci Compute Node, Solidfire & Hci Management Node, Solidfire & Hci Storage Node, Solidfire Enterprise Sds

1 product

1 product

5 products

Active Iq Unified Manager

Hci Compute Node

Solidfire & Hci Management Node

Solidfire & Hci Storage Node

Solidfire Enterprise Sds

Configuration A

7 vulnerable

Vulnerable Software	Affected Versions
Linux Linux Kernel	2.6.14 ≤ version < 4.9.326
Linux Linux Kernel	4.10 ≤ version < 4.14.291
Linux Linux Kernel	4.15 ≤ version < 4.19.255
Linux Linux Kernel	4.20 ≤ version < 5.4.209
Linux Linux Kernel	5.11 ≤ version < 5.15.59
Linux Linux Kernel	5.16 ≤ version < 5.18.16
Linux Linux Kernel	5.5 ≤ version < 5.10.135

Configuration B

2 vulnerable

Vulnerable Software	Affected Versions
Debian Debian Linux	Version 10.0
Debian Debian Linux	Version 11.0

Configuration C

5 vulnerable

Vulnerable Software	Affected Versions
Netapp Active Iq Unified Manager	All versions
Netapp Hci Compute Node	All versions
Netapp Solidfire & Hci Management Node	All versions
Netapp Solidfire & Hci Storage Node	All versions
Netapp Solidfire Enterprise Sds	All versions

References (16)

https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=99a63d36cb3ed5ca3aa6fcb64cffbeaf3b0fb164

Source: cve@mitre.org

https://lists.debian.org/debian-lts-announce/2022/09/msg00011.html

Source: cve@mitre.org

Mailing ListThird Party Advisory

https://lists.debian.org/debian-lts-announce/2022/10/msg00000.html

Source: cve@mitre.org

Mailing ListThird Party Advisory

https://marc.info/?l=netfilter-devel&m=165883202007292&w=2

Source: cve@mitre.org

Mailing ListPatchThird Party Advisory

https://security.netapp.com/advisory/ntap-20220901-0007/

Source: cve@mitre.org

Third Party Advisory

https://www.debian.org/security/2022/dsa-5207

Source: cve@mitre.org

Third Party Advisory

https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=99a63d36cb3ed5ca3aa6fcb64cffbeaf3b0fb164

Source: af854a3a-2127-422b-91ae-364da2661108

https://lists.debian.org/debian-lts-announce/2022/09/msg00011.html

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing ListThird Party Advisory

https://lists.debian.org/debian-lts-announce/2022/10/msg00000.html

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing ListThird Party Advisory

https://marc.info/?l=netfilter-devel&m=165883202007292&w=2

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing ListPatchThird Party Advisory

https://security.netapp.com/advisory/ntap-20220901-0007/

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://www.debian.org/security/2022/dsa-5207

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://cert-portal.siemens.com/productcert/html/ssa-419740.html

Source: 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e

https://cert-portal.siemens.com/productcert/html/ssa-561322.html

Source: 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e

https://cert-portal.siemens.com/productcert/html/ssa-794697.html

Source: 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e

https://cert-portal.siemens.com/productcert/html/ssa-942865.html

Source: 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e

Timeline

No history available yet.