Security readout for executives and security teams
Plain-English summary
CVE-2022-48743 is a Linux kernel bug in the AMD XGBE network driver. In certain descriptor inconsistency cases, packet length accounting can underflow and trigger a kernel BUG_ON, causing intermittent kernel panic. Business impact is mainly service disruption on affected Linux systems using this driver.
Executive priority
Treat as a moderate infrastructure reliability issue. Prioritize patching where AMD XGBE networking supports production workloads, especially systems with uptime requirements. It is not presented as actively exploited in the supplied sources.
Technical view
The amd-xgbe driver could process inconsistent hardware descriptors in a way that underflows skb data length. The kernel fix drops affected packets instead of allowing the underflow path to reach skbuff BUG_ON handling. The supplied CVSS is 5.3, local attack vector, low complexity, low privileges, and low confidentiality, integrity, and availability impact.
Likely exposure
Exposure is most likely on Linux systems running affected kernel versions with AMD XGBE networking in use. The source bundle identifies Linux as affected and lists multiple stable kernel fix commits, but it does not provide environment-specific prevalence or distribution package status.
Exploitation context
The bundle does not cite active exploitation, and KEV is false. The CVSS vector indicates local, low-privilege exploitation rather than remote unauthenticated exposure. Available evidence supports intermittent kernel panic risk, not confirmed public weaponization.
Researcher notes
The public description is narrow: skb length underflow in amd-xgbe due to inconsistent hardware descriptors, fixed by dropping malformed packets. Evidence does not include reproducer details, exploit status, or distro-level patched package mappings, so validation should focus on driver presence and kernel lineage.
Mitigation direction
- Update to a Linux kernel containing the referenced amd-xgbe stable fix.
- Check vendor or distribution advisories for the patched package version.
- Prioritize hosts using AMD XGBE networking or loading the amd-xgbe driver.
- Monitor affected systems for unexpected kernel panics until patched.
Validation and detection
- Inventory Linux kernel versions on systems using AMD XGBE hardware.
- Confirm whether the amd-xgbe driver is present or loaded.
- Map installed kernels to vendor fixed versions or referenced stable commits.
- Review kernel logs for BUG_ON or skbuff-related panic evidence.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2022-48743 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 5.3 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L1.83.4CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
5.3MediumVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/9924c80bd484340191e586110ca22bff23a49f2eCVE reference, Linux
- https://git.kernel.org/stable/c/617f9934bb37993b9813832516f318ba874bcb7dCVE reference, Linux
- https://git.kernel.org/stable/c/34aeb4da20f93ac80a6291a2dbe7b9c6460e9b26CVE reference, Linux
- https://git.kernel.org/stable/c/9892742f035f7aa7dcd2bb0750effa486db89576CVE reference, Linux
- https://git.kernel.org/stable/c/4d3fcfe8464838b3920bc2b939d888e0b792934eCVE reference, Linux
- https://git.kernel.org/stable/c/db6fd92316a254be2097556f01bccecf560e53ceCVE reference, Linux
- https://git.kernel.org/stable/c/e8f73f620fee5f52653ed2da360121e4446575c5CVE reference, Linux
- https://git.kernel.org/stable/c/5aac9108a180fc06e28d4e7fb00247ce603b72eeCVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.