Security readout for executives and security teams
Plain-English summary
This is a Linux kernel bug in netfilter OS fingerprint matching. A local, low-privileged user may cause uninitialized kernel stack data to be copied back to userspace. The business risk is mainly information disclosure on systems where untrusted users or workloads can run code.
Executive priority
Treat as a moderate-priority kernel hygiene issue. Patch during the next normal maintenance window, sooner for shared or multi-tenant Linux hosts where local code execution by less-trusted users is expected.
Technical view
The flaw is in nfnetlink_osf: nf_osf_find() can return true on mismatch, causing nft_osf to copy uninitialized memory. The CVE describes leakage of stale kernel stack data to userspace. The provided CVSS is 5.3 with local attack vector, low complexity, low privileges, and no user interaction.
Likely exposure
Exposure is most relevant to Linux systems running affected kernels where local users, tenants, or workloads can interact with the vulnerable netfilter path. The source bundle does not identify specific distributions or appliance products, so validate through vendor kernel advisories and package backport notes.
Exploitation context
The bundle marks KEV as false and provides no cited evidence of active exploitation. Based on CVSS, exploitation requires local access and low privileges. This should not be treated as a remote unauthenticated vulnerability from the available evidence.
Researcher notes
Evidence is limited to the CVE description, CVSS metadata, and Linux stable commit references. The bundle does not provide exploit reports, distribution-specific fixed versions, or operational workarounds. Avoid claiming active exploitation without additional sourced evidence.
Mitigation direction
- Update to a vendor kernel containing the referenced upstream stable fixes.
- Check distribution advisories for backported fixes for CVE-2022-48654.
- Prioritize shared hosts, multi-user systems, and container hosts with untrusted workloads.
- If patching is delayed, follow vendor guidance for any supported workaround.
- Reboot into the fixed kernel after package installation.
Validation and detection
- Inventory running Linux kernel versions across affected assets.
- Compare installed kernel packages with vendor fixed-version or backport advisory data.
- Confirm the running kernel changed after reboot, not only the installed package.
- Check whether vendor release notes reference CVE-2022-48654 or the upstream stable commits.
- Record systems where patch status cannot be proven for follow-up.
Public sources used
- CVE Program
- CVE List V5
- Linux stable commit 721ea8ac063d70c2078c4e762212705de6151764
- Linux stable commit 5d75fef3e61e797fab5c3fbba88caa74ab92ad47
- Linux stable commit 816eab147e5c6f6621922b8515ad9010ceb1735e
- Linux stable commit 633c81c0449663f57d4138326d036dc6cfad674e
- Linux stable commit 559c36c5a8d730c49ef805a72b213d3bba155cc8
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2022-48654 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 5.3 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L1.83.4CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
5.3MediumVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/721ea8ac063d70c2078c4e762212705de6151764CVE reference, Linux
- https://git.kernel.org/stable/c/5d75fef3e61e797fab5c3fbba88caa74ab92ad47CVE reference, Linux
- https://git.kernel.org/stable/c/816eab147e5c6f6621922b8515ad9010ceb1735eCVE reference, Linux
- https://git.kernel.org/stable/c/633c81c0449663f57d4138326d036dc6cfad674eCVE reference, Linux
- https://git.kernel.org/stable/c/559c36c5a8d730c49ef805a72b213d3bba155cc8CVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.