Security readout for executives and security teams
Plain-English summary
CVE-2022-49638 is a Linux kernel reliability issue in ICMP system settings. A local, low-privileged user could potentially trigger a race condition that affects availability. It is not listed as known exploited, and the public record points to kernel stable fixes rather than a standalone workaround.
Executive priority
Schedule remediation through normal kernel patch cycles, with higher priority for shared servers, developer workstations, and container hosts where untrusted users or workloads run locally. No source provided here supports emergency response for active exploitation.
Technical view
The issue is a CWE-362 data race around ICMP sysctl reads. ICMP sysctl variables may be changed concurrently while being read, so the kernel fix adds READ_ONCE() protections. CVSS 3.1 is 4.7 with local access, high attack complexity, low privileges, no confidentiality or integrity impact, and high availability impact.
Likely exposure
Exposure is mainly Linux systems running affected kernel versions or downstream builds without the stable fix. The CVE record lists affected Linux kernel versions/branches including 3.18 through 5.19-era entries. Distribution backports may change practical exposure, so validate against your OS vendor kernel advisory and package version.
Exploitation context
The CVSS vector indicates local access, low privileges, no user interaction, and high attack complexity. The source bundle does not show CISA KEV listing or other cited evidence of active exploitation. Treat this primarily as a local availability risk until vendor-specific advisories indicate otherwise.
Researcher notes
The public description is narrow: ICMP sysctl data-race fixed by READ_ONCE(). The affected-version data is kernel-centric and may not map directly to distribution package versions. Use the linked kernel stable commits and distro advisories for precise applicability.
Mitigation direction
- Update to a vendor-supported kernel containing the referenced stable fixes.
- Check your Linux distribution advisory for backported fix status.
- Prioritize multi-user systems and hosts running untrusted local workloads.
- Reboot if required to ensure the patched kernel is active.
Validation and detection
- Inventory running kernel versions across Linux assets.
- Compare installed kernel packages with vendor advisory fixed versions.
- Confirm the active kernel changed after update and reboot.
- Track exceptions where vendor guidance is not yet available.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-362: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2022-49638 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 4.7 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H13.6CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
4.7MediumVector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/1740e5922fbb705637ae9fa5203db132fc45f9f6CVE reference, Linux
- https://git.kernel.org/stable/c/53ecd09ef2fb35fa69667ae8e414ef6b00fd3bf6CVE reference, Linux
- https://git.kernel.org/stable/c/edeec63b13c252193d626c2a48d7a2f0e7016dc2CVE reference, Linux
- https://git.kernel.org/stable/c/0cba7ca667ceb06934746ddd9833a25847bde81dCVE reference, Linux
- https://git.kernel.org/stable/c/e088ceb73c24ab4774da391d54a6426f4bfaefceCVE reference, Linux
- https://git.kernel.org/stable/c/e2828e8c605853f71267825c9415437c0a93e4f2CVE reference, Linux
- https://git.kernel.org/stable/c/798c2cf57c63ab39c8aac24d6a3d50f4fa5eeb06CVE reference, Linux
- https://git.kernel.org/stable/c/48d7ee321ea5182c6a70782aa186422a70e67e22CVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.