CVE-2022-49622

In the Linux kernel, the following vulnerability has been resolved:

netfilter: nf_tables: avoid skb access on nf_stolen

When verdict is NF_STOLEN, the skb might have been freed.

When tracing is enabled, this can result in a use-after-free:

1. access to skb->nf_trace
2. access to skb->mark
3. computation of trace id
4. dump of packet payload

To avoid 1, keep a cached copy of skb->nf_trace in the trace state struct. Refresh this copy whenever verdict is != STOLEN.

Avoid 2 by skipping skb->mark access if verdict is STOLEN.

3 is avoided by precomputing the trace id.

Only dump the packet when verdict is not "STOLEN".

This vulnerability is rated as Moderate because exploitation requires local privileges or unprivileged user namespace access alongside active packet tracing, limiting the attack surface in standard production environments. In typical Red Hat Enterprise Linux deployments, nf_tables packet tracing is not enabled by default and requires administrative interaction or custom rules to activate. An attacker with appropriate local permissions could trigger a use-after-free condition during packet processing when handling stolen socket buffers, potentially leading to a system crash and denial of service.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.