Cloudanix VulnDB

CVE-2022-48748

High · 7.5

CVSS

7.5

EPSS

1.1%

Published

Jun 20, 2024

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A flaw in Linux network bridging can slowly use up memory when certain VLAN-tagged traffic is dropped, potentially causing network slowdowns or crashes until systems are updated.

Exploitation
Remote Unauthenticated
Attacker needs
None
Complexity
Low
Impact
Denial Of Service
Component
OS kernel
Class
Memory Corruption
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Memory leak in __allowed_ingress when per-VLAN state is used, VLAN snooping and stats disabled: untagged or priority-tagged frames dropped on non-forwarding PVID state without freeing skb.

Why it matters to the business

Gradual memory exhaustion on Linux bridge devices under sustained ingress traffic, leading to degraded network performance or system instability requiring reboots.

How an attack unfolds

Attacker sends repeated untagged or priority-tagged frames toward a bridge port configured with per-VLAN state, disabled snooping/stats, and a PVID not in forwarding state, causing the kernel to leak skb memory on each drop.

How to fix it

Upgrade the Linux kernel to a version containing commit 446ff1fc37c74093e81db40811a07b5a19f1d797 or later stable release that resolves the skb leak in __allowed_ingress.

How to confirm the fix worked

Verify kernel version includes the referenced commit; reproduce ingress drop scenario under disabled snooping/stats and confirm no memory growth via slabinfo or kmemleak.

Typical attack path

  1. Identify Linux host running vulnerable kernel with bridge VLAN configuration using per-VLAN state.
  2. Disable VLAN snooping and stats on the target bridge port.
  3. Send high volume of untagged or priority-tagged frames matching a PVID not in learning/forwarding state.
  4. Trigger repeated drops in __allowed_ingress without skb free, exhausting kernel memory over time.

How to detect it

Inspect kernel logs for bridge VLAN drop events, monitor slab allocator growth for skb_head_cache, and review network traffic patterns showing high volumes of untagged frames to bridge ports with non-forwarding PVID.

What your security team should do

  • Prioritize kernel upgrades on all systems using bridge VLAN configurations within 30 days.
  • Temporarily enable VLAN snooping on affected bridges as a workaround to avoid the leak path.
  • Monitor memory usage on bridge hosts and schedule maintenance windows for patching.
  • Review network segmentation to limit untrusted ingress to bridge ports.

The record

In the Linux kernel, the following vulnerability has been resolved: net: bridge: vlan: fix memory leak in __allowed_ingress When using per-vlan state, if vlan snooping and stats are disabled, untagged or priority-tagged ingress frame will go to check pvid state. If the port state is forwarding and the pvid state is not learning/forwarding, untagged or priority-tagged frame will be dropped but skb memory is not freed. Should free skb when __allowed_ingress returns false.

Affected packages

Ecosystem Package Introduced Fixed
Debian:11 linux 0 5.10.103-1
Debian:12 linux 0 5.16.7-1
Debian:13 linux 0 5.16.7-1
Linux Kernel 0 No fix
Linux Kernel 5.6.0 5.10.96
Linux Kernel a580c76d534c 446ff1fc37c7
SUSE:Enterprise Storage 7.1 kernel-64kb 0 5.3.18-150300.59.167.1
SUSE:Enterprise Storage 7.1 kernel-default 0 5.3.18-150300.59.167.1
SUSE:Enterprise Storage 7.1 kernel-default-base 0 5.3.18-150300.59.167.1.150300.18.98.1
SUSE:Enterprise Storage 7.1 kernel-docs 0 5.3.18-150300.59.167.1
SUSE:Enterprise Storage 7.1 kernel-obs-build 0 5.3.18-150300.59.167.1
SUSE:Enterprise Storage 7.1 kernel-preempt 0 5.3.18-150300.59.167.1
SUSE:Enterprise Storage 7.1 kernel-source 0 5.3.18-150300.59.167.1
SUSE:Enterprise Storage 7.1 kernel-syms 0 5.3.18-150300.59.167.1
SUSE:Linux Enterprise High Availability Extension 15 SP3 kernel-default 0 5.3.18-150300.59.167.1
SUSE:Linux Enterprise High Availability Extension 15 SP5 kernel-default 0 5.14.21-150500.55.73.1
SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS kernel-64kb 0 5.3.18-150300.59.167.1
SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS kernel-default 0 5.3.18-150300.59.167.1
SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS kernel-default-base 0 5.3.18-150300.59.167.1.150300.18.98.1
SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS kernel-docs 0 5.3.18-150300.59.167.1
SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS kernel-obs-build 0 5.3.18-150300.59.167.1
SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS kernel-preempt 0 5.3.18-150300.59.167.1
SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS kernel-source 0 5.3.18-150300.59.167.1
SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS kernel-syms 0 5.3.18-150300.59.167.1
SUSE:Linux Enterprise Live Patching 15 SP3 kernel-default 0 5.3.18-150300.59.167.1
SUSE:Linux Enterprise Live Patching 15 SP3 kernel-livepatch-SLE15-SP3_Update_46 0 1-150300.7.3.1
SUSE:Linux Enterprise Live Patching 15 SP5 kernel-default 0 5.14.21-150500.55.73.1
SUSE:Linux Enterprise Live Patching 15 SP5 kernel-livepatch-SLE15-SP5-RT_Update_17 0 1-150500.11.3.1
SUSE:Linux Enterprise Live Patching 15 SP5 kernel-livepatch-SLE15-SP5_Update_17 0 1-150500.11.3.1
SUSE:Linux Enterprise Micro 5.1 kernel-default 0 5.3.18-150300.59.167.1
SUSE:Linux Enterprise Micro 5.1 kernel-default-base 0 5.3.18-150300.59.167.1.150300.18.98.1
SUSE:Linux Enterprise Micro 5.1 kernel-rt 0 5.3.18-150300.175.1
SUSE:Linux Enterprise Micro 5.1 kernel-source-rt 0 5.3.18-150300.175.1
SUSE:Linux Enterprise Micro 5.2 kernel-default 0 5.3.18-150300.59.167.1
SUSE:Linux Enterprise Micro 5.2 kernel-default-base 0 5.3.18-150300.59.167.1.150300.18.98.1
SUSE:Linux Enterprise Micro 5.2 kernel-rt 0 5.3.18-150300.175.1
SUSE:Linux Enterprise Micro 5.2 kernel-source-rt 0 5.3.18-150300.175.1
SUSE:Linux Enterprise Micro 5.5 kernel-default 0 5.14.21-150500.55.73.1
SUSE:Linux Enterprise Micro 5.5 kernel-default-base 0 5.14.21-150500.55.73.1.150500.6.33.8
SUSE:Linux Enterprise Micro 5.5 kernel-rt 0 5.14.21-150500.13.61.1
SUSE:Linux Enterprise Micro 5.5 kernel-source-rt 0 5.14.21-150500.13.61.1
SUSE:Linux Enterprise Module for Basesystem 15 SP5 kernel-64kb 0 5.14.21-150500.55.73.1
SUSE:Linux Enterprise Module for Basesystem 15 SP5 kernel-default 0 5.14.21-150500.55.73.1
SUSE:Linux Enterprise Module for Basesystem 15 SP5 kernel-default-base 0 5.14.21-150500.55.73.1.150500.6.33.8
SUSE:Linux Enterprise Module for Basesystem 15 SP5 kernel-source 0 5.14.21-150500.55.73.1
SUSE:Linux Enterprise Module for Basesystem 15 SP5 kernel-zfcpdump 0 5.14.21-150500.55.73.1
SUSE:Linux Enterprise Module for Development Tools 15 SP5 kernel-docs 0 5.14.21-150500.55.73.2
SUSE:Linux Enterprise Module for Development Tools 15 SP5 kernel-obs-build 0 5.14.21-150500.55.73.1
SUSE:Linux Enterprise Module for Development Tools 15 SP5 kernel-source 0 5.14.21-150500.55.73.1
SUSE:Linux Enterprise Module for Development Tools 15 SP5 kernel-syms 0 5.14.21-150500.55.73.1
SUSE:Linux Enterprise Module for Legacy 15 SP5 kernel-default 0 5.14.21-150500.55.73.1
SUSE:Linux Enterprise Module for Public Cloud 15 SP5 kernel-azure 0 5.14.21-150500.33.60.1
SUSE:Linux Enterprise Module for Public Cloud 15 SP5 kernel-source-azure 0 5.14.21-150500.33.60.1
SUSE:Linux Enterprise Module for Public Cloud 15 SP5 kernel-syms-azure 0 5.14.21-150500.33.60.1
SUSE:Linux Enterprise Server 15 SP3-LTSS kernel-64kb 0 5.3.18-150300.59.167.1
SUSE:Linux Enterprise Server 15 SP3-LTSS kernel-default 0 5.3.18-150300.59.167.1
SUSE:Linux Enterprise Server 15 SP3-LTSS kernel-default-base 0 5.3.18-150300.59.167.1.150300.18.98.1
SUSE:Linux Enterprise Server 15 SP3-LTSS kernel-docs 0 5.3.18-150300.59.167.1
SUSE:Linux Enterprise Server 15 SP3-LTSS kernel-obs-build 0 5.3.18-150300.59.167.1
SUSE:Linux Enterprise Server 15 SP3-LTSS kernel-preempt 0 5.3.18-150300.59.167.1
SUSE:Linux Enterprise Server 15 SP3-LTSS kernel-source 0 5.3.18-150300.59.167.1
SUSE:Linux Enterprise Server 15 SP3-LTSS kernel-syms 0 5.3.18-150300.59.167.1
SUSE:Linux Enterprise Server 15 SP3-LTSS kernel-zfcpdump 0 5.3.18-150300.59.167.1
SUSE:Linux Enterprise Server for SAP Applications 15 SP3 kernel-default 0 5.3.18-150300.59.167.1
SUSE:Linux Enterprise Server for SAP Applications 15 SP3 kernel-default-base 0 5.3.18-150300.59.167.1.150300.18.98.1
SUSE:Linux Enterprise Server for SAP Applications 15 SP3 kernel-docs 0 5.3.18-150300.59.167.1
SUSE:Linux Enterprise Server for SAP Applications 15 SP3 kernel-obs-build 0 5.3.18-150300.59.167.1
SUSE:Linux Enterprise Server for SAP Applications 15 SP3 kernel-preempt 0 5.3.18-150300.59.167.1
SUSE:Linux Enterprise Server for SAP Applications 15 SP3 kernel-source 0 5.3.18-150300.59.167.1
SUSE:Linux Enterprise Server for SAP Applications 15 SP3 kernel-syms 0 5.3.18-150300.59.167.1
SUSE:Linux Enterprise Workstation Extension 15 SP5 kernel-default 0 5.14.21-150500.55.73.1
SUSE:Real Time Module 15 SP5 kernel-rt 0 5.14.21-150500.13.61.1
SUSE:Real Time Module 15 SP5 kernel-rt_debug 0 5.14.21-150500.13.61.1
SUSE:Real Time Module 15 SP5 kernel-source-rt 0 5.14.21-150500.13.61.1
SUSE:Real Time Module 15 SP5 kernel-syms-rt 0 5.14.21-150500.13.61.1
Ubuntu:16.04:LTS linux-hwe-edge 0 No fix
Ubuntu:18.04:LTS linux-aws-5.0 0 No fix
Ubuntu:18.04:LTS linux-aws-5.3 0 No fix
Ubuntu:18.04:LTS linux-azure 0 No fix
Ubuntu:18.04:LTS linux-azure-5.3 0 No fix
Ubuntu:18.04:LTS linux-azure-edge 0 No fix
Ubuntu:18.04:LTS linux-gcp 0 No fix
Ubuntu:18.04:LTS linux-gcp-5.3 0 No fix
Ubuntu:18.04:LTS linux-gke-4.15 0 No fix
Ubuntu:18.04:LTS linux-gke-5.4 0 No fix
Ubuntu:18.04:LTS linux-gkeop-5.4 0 No fix
Ubuntu:18.04:LTS linux-hwe 0 No fix
Ubuntu:18.04:LTS linux-hwe-edge 0 No fix
Ubuntu:18.04:LTS linux-oem 0 No fix
Ubuntu:18.04:LTS linux-oracle-5.0 0 No fix
Ubuntu:18.04:LTS linux-oracle-5.3 0 No fix
Ubuntu:20.04:LTS linux 0 5.4.0-9.12
Ubuntu:20.04:LTS linux-aws 0 5.4.0-1005.5
Ubuntu:20.04:LTS linux-aws-5.11 0 No fix
Ubuntu:20.04:LTS linux-aws-5.13 0 No fix
Ubuntu:20.04:LTS linux-aws-5.15 0 5.15.0-1014.18~20.04.1
Ubuntu:20.04:LTS linux-aws-5.8 0 No fix
Ubuntu:20.04:LTS linux-azure 0 5.4.0-1006.6
Ubuntu:20.04:LTS linux-azure-5.11 0 No fix
Ubuntu:20.04:LTS linux-azure-5.13 0 No fix
Ubuntu:20.04:LTS linux-azure-5.15 0 5.15.0-1007.8~20.04.1
Ubuntu:20.04:LTS linux-azure-5.8 0 No fix
Ubuntu:20.04:LTS linux-azure-fde 0 No fix
Ubuntu:20.04:LTS linux-azure-fde-5.15 0 5.15.0-1019.24~20.04.1.1
Ubuntu:20.04:LTS linux-bluefield 0 5.4.0-1007.10
Ubuntu:20.04:LTS linux-gcp 0 5.4.0-1005.5
Ubuntu:20.04:LTS linux-gcp-5.11 0 No fix
Ubuntu:20.04:LTS linux-gcp-5.13 0 No fix
Ubuntu:20.04:LTS linux-gcp-5.15 0 5.15.0-1006.9~20.04.1
Ubuntu:20.04:LTS linux-gcp-5.8 0 No fix
Ubuntu:20.04:LTS linux-gke 0 No fix
Ubuntu:20.04:LTS linux-gke-5.15 0 No fix
Ubuntu:20.04:LTS linux-gkeop 0 5.4.0-1008.9
Ubuntu:20.04:LTS linux-gkeop-5.15 0 5.15.0-1003.5~20.04.2
Ubuntu:20.04:LTS linux-hwe-5.11 0 No fix
Ubuntu:20.04:LTS linux-hwe-5.13 0 No fix
Ubuntu:20.04:LTS linux-hwe-5.15 0 5.15.0-33.34~20.04.1
Ubuntu:20.04:LTS linux-hwe-5.8 0 No fix
Ubuntu:20.04:LTS linux-ibm 0 5.4.0-1003.4
Ubuntu:20.04:LTS linux-ibm-5.15 0 5.15.0-1033.36~20.04.1
Ubuntu:20.04:LTS linux-intel-5.13 0 No fix
Ubuntu:20.04:LTS linux-intel-iotg-5.15 0 5.15.0-1003.5~20.04.1
Ubuntu:20.04:LTS linux-iot 0 5.4.0-1001.3
Ubuntu:20.04:LTS linux-kvm 0 5.4.0-1004.4
Ubuntu:20.04:LTS linux-lowlatency-hwe-5.15 0 5.15.0-33.34~20.04.1
Ubuntu:20.04:LTS linux-oem-5.10 0 No fix
Ubuntu:20.04:LTS linux-oem-5.13 0 No fix
Ubuntu:20.04:LTS linux-oem-5.14 0 No fix
Ubuntu:20.04:LTS linux-oem-5.6 0 No fix
Ubuntu:20.04:LTS linux-oracle 0 5.4.0-1005.5
Ubuntu:20.04:LTS linux-oracle-5.11 0 No fix
Ubuntu:20.04:LTS linux-oracle-5.13 0 No fix
Ubuntu:20.04:LTS linux-oracle-5.15 0 5.15.0-1007.9~20.04.1
Ubuntu:20.04:LTS linux-oracle-5.8 0 No fix
Ubuntu:20.04:LTS linux-raspi 0 5.4.0-1007.7
Ubuntu:20.04:LTS linux-raspi2 0 No fix
Ubuntu:20.04:LTS linux-riscv 0 No fix
Ubuntu:20.04:LTS linux-riscv-5.11 0 No fix
Ubuntu:20.04:LTS linux-riscv-5.15 0 5.15.0-1015.17~20.04.1
Ubuntu:20.04:LTS linux-riscv-5.8 0 No fix
Ubuntu:20.04:LTS linux-xilinx-zynqmp 0 5.4.0-1020.24
Ubuntu:22.04:LTS linux 0 5.15.0-22.22
Ubuntu:22.04:LTS linux-allwinner-5.19 0 No fix
Ubuntu:22.04:LTS linux-aws 0 5.15.0-1002.4
Ubuntu:22.04:LTS linux-aws-5.19 0 No fix
Ubuntu:22.04:LTS linux-aws-6.2 0 No fix
Ubuntu:22.04:LTS linux-aws-6.5 0 6.5.0-1008.8~22.04.1
Ubuntu:22.04:LTS linux-azure 0 5.15.0-1001.2
Ubuntu:22.04:LTS linux-azure-5.19 0 No fix
Ubuntu:22.04:LTS linux-azure-6.2 0 No fix
Ubuntu:22.04:LTS linux-azure-6.5 0 6.5.0-1007.7~22.04.1
Ubuntu:22.04:LTS linux-azure-fde 0 5.15.0-1019.24.1
Ubuntu:22.04:LTS linux-azure-fde-5.19 0 No fix
Ubuntu:22.04:LTS linux-azure-fde-6.2 0 No fix
Ubuntu:22.04:LTS linux-gcp 0 5.15.0-1001.3
Ubuntu:22.04:LTS linux-gcp-5.19 0 No fix
Ubuntu:22.04:LTS linux-gcp-6.2 0 No fix
Ubuntu:22.04:LTS linux-gcp-6.5 0 6.5.0-1010.10~22.04.3
Ubuntu:22.04:LTS linux-gke 0 5.15.0-1002.2
Ubuntu:22.04:LTS linux-gkeop 0 5.15.0-1001.2
Ubuntu:22.04:LTS linux-hwe-5.19 0 No fix
Ubuntu:22.04:LTS linux-hwe-6.2 0 No fix
Ubuntu:22.04:LTS linux-hwe-6.5 0 6.5.0-14.14~22.04.1
Ubuntu:22.04:LTS linux-ibm 0 5.15.0-1002.2
Ubuntu:22.04:LTS linux-intel-iotg 0 5.15.0-1004.6
Ubuntu:22.04:LTS linux-kvm 0 5.15.0-1002.2
Ubuntu:22.04:LTS linux-lowlatency 0 5.15.0-22.22
Ubuntu:22.04:LTS linux-lowlatency-hwe-5.19 0 No fix
Ubuntu:22.04:LTS linux-lowlatency-hwe-6.2 0 No fix
Ubuntu:22.04:LTS linux-lowlatency-hwe-6.5 0 6.5.0-14.14.1~22.04.1
Ubuntu:22.04:LTS linux-nvidia 0 5.15.0-1005.5
Ubuntu:22.04:LTS linux-nvidia-6.2 0 No fix
Ubuntu:22.04:LTS linux-nvidia-6.5 0 6.5.0-1004.4
Ubuntu:22.04:LTS linux-nvidia-6.8 0 6.8.0-1008.8~22.04.1
Ubuntu:22.04:LTS linux-oem-5.17 0 No fix
Ubuntu:22.04:LTS linux-oem-6.0 0 No fix
Ubuntu:22.04:LTS linux-oem-6.1 0 No fix
Ubuntu:22.04:LTS linux-oem-6.5 0 6.5.0-1003.3
Ubuntu:22.04:LTS linux-oracle 0 5.15.0-1001.3
Ubuntu:22.04:LTS linux-oracle-6.5 0 6.5.0-1013.13~22.04.4
Ubuntu:22.04:LTS linux-raspi 0 5.15.0-1003.3
Ubuntu:22.04:LTS linux-riscv 0 No fix
Ubuntu:22.04:LTS linux-riscv-5.19 0 No fix
Ubuntu:22.04:LTS linux-riscv-6.5 0 6.5.0-17.17.1.1~22.04.1
Ubuntu:22.04:LTS linux-starfive-5.19 0 No fix
Ubuntu:22.04:LTS linux-starfive-6.2 0 No fix
Ubuntu:22.04:LTS linux-starfive-6.5 0 6.5.0-1007.8~22.04.1
Ubuntu:22.04:LTS linux-xilinx-zynqmp 0 5.15.0-1022.26
Ubuntu:24.04:LTS linux 0 6.5.0-9.9
Ubuntu:24.04:LTS linux-aws 0 6.5.0-1008.8
Ubuntu:24.04:LTS linux-azure 0 6.5.0-1007.7
Ubuntu:24.04:LTS linux-gcp 0 6.5.0-1007.7
Ubuntu:24.04:LTS linux-gke 0 6.8.0-1003.5
Ubuntu:24.04:LTS linux-gkeop 0 6.8.0-1001.3
Ubuntu:24.04:LTS linux-ibm 0 6.5.0-1009.9
Ubuntu:24.04:LTS linux-lowlatency 0 6.5.0-9.9.1
Ubuntu:24.04:LTS linux-nvidia 0 6.8.0-1007.7
Ubuntu:24.04:LTS linux-nvidia-lowlatency 0 6.8.0-1009.9.1
Ubuntu:24.04:LTS linux-oem-6.8 0 6.8.0-1003.3
Ubuntu:24.04:LTS linux-oracle 0 6.5.0-1010.10

Related vulnerabilities