CVE-2022-48855: 
Linux Kernel vulnerability analysis and mitigation

CVE-2022-48855 is a kernel information leak vulnerability in the Linux kernel's SCTP (Stream Control Transmission Protocol) sockets implementation. The vulnerability was discovered when syzbot reported a 4-byte kernel information leak. The issue occurs when r->idiagexpires is not initialized if inetsctpdiagfill() calls inetdiagmsgcommonfill() (Kernel Patch).

The vulnerability exists in the SCTP diagnostic interface where uninitialized memory could be exposed to userspace. Specifically, when inetsctpdiagfill() calls inetdiagmsgcommonfill(), the idiagexpires field remains uninitialized, leading to a potential leak of 4 bytes of kernel memory. The issue has a CVSS v3.1 Base Score of 7.1 HIGH with vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H (NVD).

The vulnerability allows local attackers to read uninitialized kernel memory, potentially exposing sensitive information. This could lead to information disclosure and local privilege escalation opportunities (NVD).

The vulnerability has been fixed by initializing the idiagtimer, idiagretrans, and idiagexpires fields at the beginning of the inetsctpdiagfill() function, ensuring no uninitialized data is exposed to userspace. The fix has been implemented in various kernel versions through backported patches (Kernel Patch).