CVE-2022-48691: 
Linux Kernel vulnerability analysis and mitigation

CVE-2022-48691 is a memory leak vulnerability discovered in the Linux kernel's netfilter nf_tables component. The issue was disclosed on May 3, 2024, and affects Linux kernel versions from 5.5 through 5.19.9. The vulnerability occurs when the offload flags check fails in the netfilter component, specifically in the hook list cleanup process (NVD).

The vulnerability manifests as a memory leak in the nf_tables component when the offload flags check fails. The issue occurs because the hook list is not properly cleaned up, preventing nft_chain_release_hook() from releasing the hooks. This results in an unreferenced object of size 96 bytes remaining in memory. The vulnerability was identified through a backtrace showing the leak occurring in the nft_netdev_hook_alloc function within net/netfilter/nf_tables_api.c (Kernel Patch).

The vulnerability has been assigned a CVSS v3.1 Base Score of 5.5 (MEDIUM) with a vector of CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H. The primary impact is a memory leak that could lead to resource exhaustion over time, potentially affecting system stability (NVD).

The vulnerability requires local access and low privileges to exploit. It can be triggered through the netfilter nf_tables component when handling hook lists during offload flag checks. The issue has been demonstrated through a proof-of-concept that shows the memory leak occurring in a controlled environment (Kernel Patch).

The vulnerability has been fixed through a patch that properly handles the hook list cleanup by splicing back the hook list when the offload flags check fails. The fix ensures that nft_chain_release_hook() can properly release the hooks. Users should update to patched kernel versions that include the fix (Kernel Patch).