CVE-2022-48936: Software Security Vulnerability Vulnerability

MODERATE
Advisory Identifier: GHSA-frr7-rgvg-v3p9
Share
CVSS 5.5
Published
Advisory Summary

CVE-2022-48936 is a MODERATE (CVSS 5.5) security vulnerability vulnerability (General Security Weakness) affecting Software libraries in the Maven ecosystem. Remediation is available in the latest vendor maintenance releases.

CVE-2022-48936 at a Glance

CVE Identifier CVE-2022-48936
GHSA Identifier GHSA-frr7-rgvg-v3p9
Severity MODERATE
CVSS v3.1 Base Score 5.5
CWE Classification General Security Weakness
Affected Product Software
Package Ecosystem Maven
Published Date
Last Updated

Security Impact

CVSS: 5.5

The security impact metrics below are parsed directly from the CVSS v3.1 vector string (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).

Attack Vector Local (AV:L)
Attack Complexity Low (AC:L)
Privileges Required Low (PR:L)
User Interaction None (UI:N)
Scope Unchanged (S:U)
Confidentiality None (C:N)
Integrity None (I:N)
Availability High (A:H)

How to Fix CVE-2022-48936

To remediate this vulnerability, upgrade all affected Software dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release: 

mvn dependency:tree

How to Check if You Are Affected

To determine whether your Java application is affected by CVE-2022-48936, inspect your build dependencies using the Maven Dependency Plugin:

mvn dependency:tree

Analyze the terminal output to locate any version of Software in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than the patched release), your application is affected.

Note: The mvn dependency:tree command inspects the resolved dependency graph declared in your project's POM files; it does not perform automated security scanning or inspect runtime dynamic classpaths. Always verify runtime container classpaths and shaded JARs.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under General Security Weakness. In Software, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

In the Linux kernel, the following vulnerability has been resolved: gso: do not skip outer ip header in case of ipip and net_failover We encounter a tcp drop issue in our cloud environment. Packet GROed in host forwards to a VM virtio_net nic with net_failover enabled. VM acts as a IPVS LB with ipip encapsulation. The full path like: host gro -> vm virtio_net rx -> net_failover rx -> ipvs fullnat -> ipip encap -> net_failover tx -> virtio_net tx When net_failover transmits a ipip pkt (gso_type = 0x0103, which means SKB_GSO_TCPV4, SKB_GSO_DODGY and SKB_GSO_IPXIP4), there is no gso did because it supports TSO and GSO_IPXIP4. But network_header points to inner ip header. Call Trace: tcp4_gso_segment ------> return NULL inet_gso_segment ------> inner iph, network_header points to ipip_gso_segment inet_gso_segment ------> outer iph skb_mac_gso_segment Afterwards virtio_net transmits the pkt, only inner ip header is modified. And the outer one just keeps unchanged. The pkt will be dropped in remote host. Call Trace: inet_gso_segment ------> inner iph, outer iph is skipped skb_mac_gso_segment __skb_gso_segment validate_xmit_skb validate_xmit_skb_list sch_direct_xmit __qdisc_run __dev_queue_xmit ------> virtio_net dev_hard_start_xmit __dev_queue_xmit ------> net_failover ip_finish_output2 ip_output iptunnel_xmit ip_tunnel_xmit ipip_tunnel_xmit ------> ipip dev_hard_start_xmit __dev_queue_xmit ip_finish_output2 ip_output ip_forward ip_rcv __netif_receive_skb_one_core netif_receive_skb_internal napi_gro_receive receive_buf virtnet_poll net_rx_action The root cause of this issue is specific with the rare combination of SKB_GSO_DODGY and a tunnel device that adds an SKB_GSO_ tunnel option. SKB_GSO_DODGY is set from external virtio_net. We need to reset network header when callbacks.gso_segment() returns NULL. This patch also includes ipv6_gso_segment(), considering SIT, etc.

References

NVD — CVE-2022-48936 NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-48936
git.kernel.org/stable/c/2b3cdd70ea... WEB
https://git.kernel.org/stable/c/2b3cdd70ea5f5a694f95ea1788393fb3b83071ea
git.kernel.org/stable/c/45d006c2c7... WEB
https://git.kernel.org/stable/c/45d006c2c7ed7baf1fa258fa7b5bc9923d3a983e
git.kernel.org/stable/c/7840e55979... WEB
https://git.kernel.org/stable/c/7840e559799a08a8588ee6de27516a991cb2e5e7
git.kernel.org/stable/c/899e56a1ad... WEB
https://git.kernel.org/stable/c/899e56a1ad435261812355550ae869d8be3df395
git.kernel.org/stable/c/a739963f43... WEB
https://git.kernel.org/stable/c/a739963f43269297c3f438b776194542e2a97499
git.kernel.org/stable/c/cc20cced05... WEB
https://git.kernel.org/stable/c/cc20cced0598d9a5ff91ae4ab147b3b5e99ee819
git.kernel.org/stable/c/dac2490d9e... WEB
https://git.kernel.org/stable/c/dac2490d9ee0b89dffc72f1172b8bbeb60eaec39
git.kernel.org/stable/c/e9ffbe63f6... WEB
https://git.kernel.org/stable/c/e9ffbe63f6f32f526a461756309b61c395168d73

Frequently Asked Questions

What is CVE-2022-48936?
CVE-2022-48936 is a security vulnerability in Software classified as a security vulnerability vulnerability under General Security Weakness.
Which Software versions are affected?
Affected versions include releases prior to current release patches.
What version fixes CVE-2022-48936?
Upgrading to current release patches (or the latest patched release for your respective branch) resolves the vulnerability.
What is the CVSS score of CVE-2022-48936?
CVE-2022-48936 has a CVSS v3.1 base score of 5.5 (MODERATE) with vector string CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H.
What CWE is associated with CVE-2022-48936?
CVE-2022-48936 is classified under General Security Weakness.
How can I check Maven dependencies for CVE-2022-48936?
Run the dependency tree command: 'mvn dependency:tree'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON OSV v1.5 Schema
Normalized schema output
View Raw JSON 
{
  "schema_version" : "1.4.0",
  "id" : "GHSA-frr7-rgvg-v3p9",
  "modified" : "2024-08-22T21:31:29Z",
  "published" : "2024-08-22T06:30:29Z",
  "aliases" : [ "CVE-2022-48936" ],
  "details" : "In the Linux kernel, the following vulnerability has been resolved:\n\ngso: do not skip outer ip header in case of ipip and net_failover\n\nWe encounter a tcp drop issue in our cloud environment. Packet GROed in\nhost forwards to a VM virtio_net nic with net_failover enabled. VM acts\nas a IPVS LB with ipip encapsulation. The full path like:\nhost gro -> vm virtio_net rx -> net_failover rx -> ipvs fullnat\n -> ipip encap -> net_failover tx -> virtio_net tx\n\nWhen net_failover transmits a ipip pkt (gso_type = 0x0103, which means\nSKB_GSO_TCPV4, SKB_GSO_DODGY and SKB_GSO_IPXIP4), there is no gso\ndid because it supports TSO and GSO_IPXIP4. But network_header points to\ninner ip header.\n\nCall Trace:\n tcp4_gso_segment        ------> return NULL\n inet_gso_segment        ------> inner iph, network_header points to\n ipip_gso_segment\n inet_gso_segment        ------> outer iph\n skb_mac_gso_segment\n\nAfterwards virtio_net transmits the pkt, only inner ip header is modified.\nAnd the outer one just keeps unchanged. The pkt will be dropped in remote\nhost.\n\nCall Trace:\n inet_gso_segment        ------> inner iph, outer iph is skipped\n skb_mac_gso_segment\n __skb_gso_segment\n validate_xmit_skb\n validate_xmit_skb_list\n sch_direct_xmit\n __qdisc_run\n __dev_queue_xmit        ------> virtio_net\n dev_hard_start_xmit\n __dev_queue_xmit        ------> net_failover\n ip_finish_output2\n ip_output\n iptunnel_xmit\n ip_tunnel_xmit\n ipip_tunnel_xmit        ------> ipip\n dev_hard_start_xmit\n __dev_queue_xmit\n ip_finish_output2\n ip_output\n ip_forward\n ip_rcv\n __netif_receive_skb_one_core\n netif_receive_skb_internal\n napi_gro_receive\n receive_buf\n virtnet_poll\n net_rx_action\n\nThe root cause of this issue is specific with the rare combination of\nSKB_GSO_DODGY and a tunnel device that adds an SKB_GSO_ tunnel option.\nSKB_GSO_DODGY is set from external virtio_net. We need to reset network\nheader when callbacks.gso_segment() returns NULL.\n\nThis patch also includes ipv6_gso_segment(), considering SIT, etc.",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
  } ],
  "affected" : [ ],
  "references" : [ {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2022-48936"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/2b3cdd70ea5f5a694f95ea1788393fb3b83071ea"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/45d006c2c7ed7baf1fa258fa7b5bc9923d3a983e"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/7840e559799a08a8588ee6de27516a991cb2e5e7"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/899e56a1ad435261812355550ae869d8be3df395"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/a739963f43269297c3f438b776194542e2a97499"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/cc20cced0598d9a5ff91ae4ab147b3b5e99ee819"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/dac2490d9ee0b89dffc72f1172b8bbeb60eaec39"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/e9ffbe63f6f32f526a461756309b61c395168d73"
  } ],
  "database_specific" : {
    "cwe_ids" : [ ],
    "severity" : "MODERATE",
    "github_reviewed" : false,
    "github_reviewed_at" : null,
    "nvd_published_at" : "2024-08-22T04:15:16Z"
  }
}