CVE-2022-48711

What it actually does

Missing bounds checks in tipc_mon_rcv and tipc_link_proto_rcv allow a received domain_record to contain more members than MAX_MON_DOMAIN or a 32-bit length value to be truncated into a uint16, enabling stack overflow in the Linux kernel TIPC stack.

Why it matters to the business

Kernel memory corruption on systems using the TIPC protocol can produce remote denial of service or potential code execution, risking cluster or network-node stability in affected Linux deployments.

How an attack unfolds

An attacker reachable via a TIPC bearer sends a crafted link-protocol message containing an oversized domain record; tipc_link_proto_rcv reads the length field and tipc_mon_rcv copies the member list without checking MAX_MON_DOMAIN, overflowing a stack buffer.

How to fix it

Upgrade the Linux kernel to a version containing commit 175db196e45d6f0e6047eccd09c8ba55465eb131 or later; apply the backported fix for CVE-2022-0435 if running an older stable tree.

How to confirm the fix worked

Confirm the patch commit is present in the running kernel source; test that tipc_mon_rcv rejects domain records whose member count exceeds MAX_MON_DOMAIN and that length fields are validated before uint16 conversion.

Typical attack path

1. Establish or hijack a TIPC bearer link to a target node
2. Craft a link-protocol message with domain_record member count exceeding MAX_MON_DOMAIN
3. Deliver the message so that tipc_link_proto_rcv and tipc_mon_rcv process the record
4. Trigger stack overflow leading to kernel crash or controlled execution

How to detect it

Review kernel logs for TIPC stack traces or oops messages referencing tipc_mon_rcv or domain_record processing; inspect network captures for TIPC link-protocol messages with unexpectedly large payload lengths.

What your security team should do

• Prioritize kernel updates on all systems exposing TIPC bearers
• Disable TIPC on hosts that do not require it
• Monitor for unusually large TIPC protocol frames after patching