CVE-2022-48654

What it actually does

nf_osf_find incorrectly returns a match on mismatch, causing nft_osf to copy uninitialized kernel stack memory into userspace buffers and leak stale data.

Why it matters to the business

Local users on affected Linux systems may obtain fragments of kernel memory that could contain sensitive information such as credentials or internal state, increasing the risk of further attacks on the host.

How an attack unfolds

An attacker with local access crafts an OS fingerprint packet that triggers the flawed nf_osf_find logic, then uses the nft_osf rule to force the kernel to return uninitialized stack data in the response, allowing the attacker to read kernel memory.

How to fix it

Upgrade the Linux kernel to a version containing commit 721ea8ac063d70c2078c4e762212705de6151764 or later; rebuild and reboot with the patched kernel.

How to confirm the fix worked

Confirm the running kernel contains commit 721ea8ac063d70c2078c4e762212705de6151764 by checking /proc/version or the kernel build log; test that nft_osf no longer returns uninitialized data on mismatch packets.

Typical attack path

1. Obtain local shell or user context on a vulnerable Linux system
2. Load or trigger a netfilter ruleset containing an nft_osf expression
3. Send a specially chosen packet that exercises nf_osf_find with a mismatch
4. Read the returned userspace buffer containing leaked kernel stack bytes
5. Parse the leaked data for useful information such as pointers or credentials

How to detect it

Review kernel audit logs and nftables trace events for unexpected osf matches; inspect any userspace processes that interact with nfnetlink and nft_osf for anomalous buffer contents.

What your security team should do

• Prioritize kernel updates on all systems exposing netfilter to untrusted local users
• Audit nftables rulesets for use of the osf expression and restrict its availability
• Monitor for local information-disclosure attempts via kernel audit logs