CVE-2022-49632: 
Linux Kernel vulnerability analysis and mitigation

CVE-2022-49632 is a data race vulnerability discovered in the Linux kernel's ICMP error handling mechanism. The issue specifically affects the sysctl_icmp_errors_use_inbound_ifaddr variable, which can be concurrently modified while being read, leading to potential race conditions (Kernel Commit).

The vulnerability exists in the Linux kernel's ICMP implementation where the sysctl_icmp_errors_use_inbound_ifaddr variable could be accessed without proper synchronization. The issue was fixed by adding READ_ONCE() to the reader of this variable to ensure atomic access. The vulnerability has a CVSS v3.1 Base Score of 4.7 (Medium) with the following vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H (AttackerKB).

The vulnerability primarily affects system availability. According to the CVSS metrics, while there is no impact on confidentiality or integrity, it can have a high impact on system availability due to potential race conditions in ICMP error handling (AttackerKB).

The vulnerability requires local access and has high attack complexity. It needs low privileges to exploit and no user interaction. The attack vector is local, indicating that the attacker must have prior access to the targeted system (AttackerKB).

The vulnerability has been patched in the Linux kernel by adding READ_ONCE() to properly handle concurrent access to sysctl_icmp_errors_use_inbound_ifaddr. The fix was implemented in commit d2efabce81db7eed1c98fa1a3f203f0edd738ac3 (Kernel Commit).