Security readout for executives and security teams
Plain-English summary
CVE-2022-49369 is a Linux kernel memory leak in AMT packet handling. Affected systems could lose kernel memory when certain received packets are not freed, potentially degrading availability. The CVE is medium severity and availability-focused; the provided sources do not show data theft, integrity impact, or confirmed active exploitation.
Executive priority
Treat as a moderate availability risk. It should be handled through normal kernel patch cycles, with faster action for shared servers, container hosts, and systems where local low-privilege users are untrusted.
Technical view
In Linux kernel AMT handling, amt_rcv() may fail to free a received skb when no socket is found, creating a possible memory leak. The CVSS vector is local, low complexity, low privilege, no user interaction, with high availability impact and no confidentiality or integrity impact.
Likely exposure
Exposure is most relevant to Linux systems running affected kernel versions or builds containing the vulnerable AMT code. The bundle lists Linux 5.16-era affected metadata and stable kernel fix commits. Asset owners should confirm their exact kernel package lineage with their Linux distribution or kernel source.
Exploitation context
The provided bundle marks KEV as false and includes no cited evidence of active exploitation. CVSS indicates local access and low privileges are required. The practical concern is resource exhaustion or service degradation, not direct compromise or data exposure based on the supplied evidence.
Researcher notes
Evidence is limited to the CVE description, CVSS, affected metadata, and three kernel stable commit references. The affected version data in the bundle is terse, so validation should rely on exact kernel source or distribution backport status rather than version names alone.
Mitigation direction
- Update to a kernel build containing the referenced stable AMT fixes.
- Check Linux distribution advisories for packaged kernel backports.
- Prioritize exposed multi-user or untrusted workload hosts first.
- If no package is available, monitor vendor guidance and maintenance branches.
Validation and detection
- Inventory Linux kernel versions and package release identifiers.
- Confirm whether AMT support and affected code are present in deployed kernels.
- Map running kernels to the referenced stable fix commits or distro backports.
- Review kernel or system monitoring for unusual memory pressure on affected hosts.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-401: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2022-49369 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 5.5 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H1.83.6CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
5.5MediumVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/60d9c020c69977e138727b3577bc6a0458325e9cCVE reference, Linux
- https://git.kernel.org/stable/c/4b8032d39b276c52db57ff834c300405b9da2691CVE reference, Linux
- https://git.kernel.org/stable/c/1a1a0e80e005cbdc2c250fc858e1d8570f4e4acbCVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Missing Release of Memory after Effective Lifetime
Missing Release of Memory after Effective Lifetime represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.