Security readout for executives and security teams
Plain-English summary
CVE-2022-48855 is a Linux kernel information leak in SCTP socket diagnostics. A kernel path could return four bytes of uninitialized kernel memory to user space. The public record does not provide CVSS scoring or evidence of active exploitation, so urgency depends on where affected kernels and SCTP-capable systems exist.
Executive priority
Treat this as a routine-to-prioritized kernel hygiene item, not an emergency based on current evidence. Patch exposed or multi-tenant Linux fleets first because even small kernel memory disclosures can help later attacks when chained with other weaknesses.
Technical view
The flaw is in Linux SCTP diagnostic handling. When inet_sctp_diag_fill() calls inet_diag_msg_common_fill(), r->idiag_expires may be uninitialized, causing a 4-byte kernel infoleak through netlink socket diagnostic output. The fix clears idiag_timer, idiag_retrans, and idiag_expires before SCTP association-specific filling.
Likely exposure
Exposure is most relevant to Linux systems running affected kernel versions or vendor kernels missing the stable backport. The source record names Linux kernels including 4.7 and several stable lines up to 5.17. Products are not specified beyond Linux, so distribution-level impact must be confirmed from vendor kernel advisories.
Exploitation context
The issue was reported by syzbot/KMSAN, not by a public exploitation report. CISA KEV status is false in the provided bundle. The source evidence supports local information disclosure through kernel socket diagnostic handling, but does not establish active exploitation, remote exploitability, or privilege escalation.
Researcher notes
The public record gives strong root-cause detail but limited operational mapping. It identifies a four-byte uninitialized field leak and references stable kernel commits, but lacks CVSS, CWE, exploit maturity, and distribution package mapping. Avoid claiming affected appliances or exploitation without vendor-specific evidence.
Mitigation direction
- Apply a vendor kernel update containing the upstream SCTP diagnostic infoleak fix.
- For custom kernels, backport the relevant stable commit for the maintained branch.
- Check distribution advisories before changing SCTP configuration as a workaround.
- Prioritize shared, multi-user, container-host, and sensitive workload kernels.
Validation and detection
- Inventory Linux kernel versions and vendor kernel package revisions.
- Confirm kernel changelogs include the referenced SCTP infoleak fix or stable commit.
- Check whether SCTP support is enabled on high-value hosts.
- Record exceptions where vendor guidance has not yet mapped affected package versions.
Public sources used
- CVE Program
- CVE List V5
- Linux stable commit 3fc0fd724d199e061432b66a8d85b7d48fe485f7
- Linux stable commit 41a2864cf719c17294f417726edd411643462ab8
- Linux stable commit 2d8fa3fdf4542a2174a72d92018f488d65d848c5
- Linux stable commit bbf59d7ae558940cfa2b36a287fd1e88d83f89f8
- Linux stable commit b7e4d9ba2ddb78801488b4c623875b81fb46b545
- Linux stable commit 1502f15b9f29c41883a6139f2923523873282a83
- Linux stable commit d828b0fe6631f3ae8709ac9a10c77c5836c76a08
- Linux stable commit 633593a808980f82d251d0ca89730d8bb8b0220c
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2022-48855 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/3fc0fd724d199e061432b66a8d85b7d48fe485f7CVE reference, Linux
- https://git.kernel.org/stable/c/41a2864cf719c17294f417726edd411643462ab8CVE reference, Linux
- https://git.kernel.org/stable/c/2d8fa3fdf4542a2174a72d92018f488d65d848c5CVE reference, Linux
- https://git.kernel.org/stable/c/bbf59d7ae558940cfa2b36a287fd1e88d83f89f8CVE reference, Linux
- https://git.kernel.org/stable/c/b7e4d9ba2ddb78801488b4c623875b81fb46b545CVE reference, Linux
- https://git.kernel.org/stable/c/1502f15b9f29c41883a6139f2923523873282a83CVE reference, Linux
- https://git.kernel.org/stable/c/d828b0fe6631f3ae8709ac9a10c77c5836c76a08CVE reference, Linux
- https://git.kernel.org/stable/c/633593a808980f82d251d0ca89730d8bb8b0220cCVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.