CVE-2022-48831 - Vulnerability Details - OpenCVE

In the Linux kernel, the following vulnerability has been resolved: ima: fix reference leak in asymmetric_verify() Don't leak a reference to the key if its algorithm is unknown.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact partial

Vendors	Products
Linux	Linux Kernel

Configuration 1 [-]

OR	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel:5.17:rc1::::::
	cpe:2.3:o:linux:linux_kernel:5.17:rc2::::::
	cpe:2.3:o:linux:linux_kernel:5.17:rc3::::::

No data.

References

Link	Providers
https://git.kernel.org/stable/c/0838d6d68182f0b28a5434bc6d50727c4757e35b
https://git.kernel.org/stable/c/89f586d3398f4cc0432ed870949dffb702940754
https://git.kernel.org/stable/c/926fd9f23b27ca6587492c3f58f4c7f4cd01dad5
https://lore.kernel.org/linux-cve-announce/2024071653-CVE-2022-48831-d6b7@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2022-48831
https://www.cve.org/CVERecord?id=CVE-2022-48831

History

Thu, 25 Sep 2025 20:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		NVD-CWE-Other
CPEs		cpe:2.3:o:linux:linux_kernel:::::::: cpe:2.3:o:linux:linux_kernel:5.17:rc1:::::: cpe:2.3:o:linux:linux_kernel:5.17:rc2:::::: cpe:2.3:o:linux:linux_kernel:5.17:rc3::::::

Wed, 11 Sep 2024 13:30:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2024-07-16T11:44:14.639Z

Updated: 2025-05-04T08:24:14.597Z

Reserved: 2024-07-16T11:38:08.904Z

Link: CVE-2022-48831

Vulnrichment

Updated: 2024-08-03T15:25:01.814Z

NVD

Status : Analyzed

Published: 2024-07-16T12:15:06.683

Modified: 2025-09-25T20:08:29.760

Link: CVE-2022-48831

Redhat

Severity : Moderate

Publid Date: 2024-07-16T00:00:00Z

Links: CVE-2022-48831 - Bugzilla

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2022-48831", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-07-16T11:38:08.904Z", "datePublished": "2024-07-16T11:44:14.639Z", "dateUpdated": "2025-05-04T08:24:14.597Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2025-05-04T08:24:14.597Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nima: fix reference leak in asymmetric_verify()\n\nDon't leak a reference to the key if its algorithm is unknown."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["security/integrity/digsig_asymmetric.c"], "versions": [{"version": "947d70597236dd5ae65c1f68c8eabfb962ee5a6b", "lessThan": "0838d6d68182f0b28a5434bc6d50727c4757e35b", "status": "affected", "versionType": "git"}, {"version": "947d70597236dd5ae65c1f68c8eabfb962ee5a6b", "lessThan": "89f586d3398f4cc0432ed870949dffb702940754", "status": "affected", "versionType": "git"}, {"version": "947d70597236dd5ae65c1f68c8eabfb962ee5a6b", "lessThan": "926fd9f23b27ca6587492c3f58f4c7f4cd01dad5", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["security/integrity/digsig_asymmetric.c"], "versions": [{"version": "5.13", "status": "affected"}, {"version": "0", "lessThan": "5.13", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.24", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.16.10", "lessThanOrEqual": "5.16.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.17", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.13", "versionEndExcluding": "5.15.24"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.13", "versionEndExcluding": "5.16.10"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.13", "versionEndExcluding": "5.17"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/0838d6d68182f0b28a5434bc6d50727c4757e35b"}, {"url": "https://git.kernel.org/stable/c/89f586d3398f4cc0432ed870949dffb702940754"}, {"url": "https://git.kernel.org/stable/c/926fd9f23b27ca6587492c3f58f4c7f4cd01dad5"}], "title": "ima: fix reference leak in asymmetric_verify()", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T15:25:01.814Z"}, "title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/0838d6d68182f0b28a5434bc6d50727c4757e35b", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/89f586d3398f4cc0432ed870949dffb702940754", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/926fd9f23b27ca6587492c3f58f4c7f4cd01dad5", "tags": ["x_transferred"]}]}, {"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2022-48831", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-09-10T16:57:27.377562Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-11T17:34:11.023Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/0838d6d68182f0b28a5434bc6d50727c4757e35b", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/89f586d3398f4cc0432ed870949dffb702940754", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/926fd9f23b27ca6587492c3f58f4c7f4cd01dad5", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T15:25:01.814Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2022-48831", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-09-10T16:57:27.377562Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-11T12:42:21.220Z"}}], "cna": {"title": "ima: fix reference leak in asymmetric_verify()", "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "947d70597236dd5ae65c1f68c8eabfb962ee5a6b", "lessThan": "0838d6d68182f0b28a5434bc6d50727c4757e35b", "versionType": "git"}, {"status": "affected", "version": "947d70597236dd5ae65c1f68c8eabfb962ee5a6b", "lessThan": "89f586d3398f4cc0432ed870949dffb702940754", "versionType": "git"}, {"status": "affected", "version": "947d70597236dd5ae65c1f68c8eabfb962ee5a6b", "lessThan": "926fd9f23b27ca6587492c3f58f4c7f4cd01dad5", "versionType": "git"}], "programFiles": ["security/integrity/digsig_asymmetric.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "5.13"}, {"status": "unaffected", "version": "0", "lessThan": "5.13", "versionType": "semver"}, {"status": "unaffected", "version": "5.15.24", "versionType": "semver", "lessThanOrEqual": "5.15.*"}, {"status": "unaffected", "version": "5.16.10", "versionType": "semver", "lessThanOrEqual": "5.16.*"}, {"status": "unaffected", "version": "5.17", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["security/integrity/digsig_asymmetric.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/0838d6d68182f0b28a5434bc6d50727c4757e35b"}, {"url": "https://git.kernel.org/stable/c/89f586d3398f4cc0432ed870949dffb702940754"}, {"url": "https://git.kernel.org/stable/c/926fd9f23b27ca6587492c3f58f4c7f4cd01dad5"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nima: fix reference leak in asymmetric_verify()\n\nDon't leak a reference to the key if its algorithm is unknown."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.15.24", "versionStartIncluding": "5.13"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.16.10", "versionStartIncluding": "5.13"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.17", "versionStartIncluding": "5.13"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2025-05-04T08:24:14.597Z"}}}, "cveMetadata": {"cveId": "CVE-2022-48831", "state": "PUBLISHED", "dateUpdated": "2025-05-04T08:24:14.597Z", "dateReserved": "2024-07-16T11:38:08.904Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2024-07-16T11:44:14.639Z", "assignerShortName": "Linux"}, "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "61670291-2496-4A61-A6FB-88E2748A3D89", "versionEndExcluding": "5.15.24", "versionStartIncluding": "5.13", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "679523BA-1392-404B-AB85-F5A5408B1ECC", "versionEndExcluding": "5.16.10", "versionStartIncluding": "5.16", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:5.17:rc1:*:*:*:*:*:*", "matchCriteriaId": "7BD5F8D9-54FA-4CB0-B4F0-CB0471FDDB2D", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:5.17:rc2:*:*:*:*:*:*", "matchCriteriaId": "E6E34B23-78B4-4516-9BD8-61B33F4AC49A", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:5.17:rc3:*:*:*:*:*:*", "matchCriteriaId": "C030FA3D-03F4-4FB9-9DBF-D08E5CAC51AA", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nima: fix reference leak in asymmetric_verify()\n\nDon't leak a reference to the key if its algorithm is unknown."}, {"lang": "es", "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: ima: corrige la fuga de referencia en ametric_verify() No filtre una referencia a la clave si se desconoce su algoritmo."}], "id": "CVE-2022-48831", "lastModified": "2025-09-25T20:08:29.760", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2024-07-16T12:15:06.683", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/0838d6d68182f0b28a5434bc6d50727c4757e35b"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/89f586d3398f4cc0432ed870949dffb702940754"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/926fd9f23b27ca6587492c3f58f4c7f4cd01dad5"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/0838d6d68182f0b28a5434bc6d50727c4757e35b"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/89f586d3398f4cc0432ed870949dffb702940754"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/926fd9f23b27ca6587492c3f58f4c7f4cd01dad5"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-Other"}], "source": "nvd@nist.gov", "type": "Primary"}]}