Skip to content
Fencer Vulns
medium 6.5

CVE-2022-3643 json

Guests can trigger NIC interface reset/abort/crash via netback It is possible for a guest to trigger a NIC interface reset/abort/crash in a…

published 2022-12-07 3 y ago modified 2026-06-17 4 mo ago also EUVD-2022-43003

cvss
6.5
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
0.5%
EPSS 0.5% chance of exploitation in 30 days, percentile 42%
public exploits
0
none known

Summary

Guests can trigger NIC interface reset/abort/crash via netback It is possible for a guest to trigger a NIC interface reset/abort/crash in a Linux based network backend by sending certain kinds of packets. It appears to be an (unwritten?) assumption in the rest of the Linux network stack that packet protocol headers are all contained within the linear section of the SKB and some NICs behave badly if this is not the case. This has been reported to occur with Cisco (enic) and Broadcom NetXtrem II BCM5780 (bnx2x) though it may be an issue with other NICs/drivers as well. In case the frontend is sending requests with split headers, netback will forward those violating above mentioned assumption to the networking core, resulting in said misbehavior.

Patch / fix

  • linux linux_kernel 4.9.336, 4.14.302, 4.19.269, 5.4.227, 5.10.159, 5.15.83, 6.0.13
  • linux Debian 14, Debian 13, Debian 12 6.1.4-1

debian advisories DEBIAN-CVE-2022-3643

  • linux Ubuntu 18.04 LTS 4.15.0-202.213
  • linux Ubuntu 20.04 LTS 5.4.0-137.154
  • linux Ubuntu 22.04 LTS 5.15.0-58.64
  • linux-aws Ubuntu 18.04 LTS 4.15.0-1148.160
  • linux-aws Ubuntu 20.04 LTS 5.4.0-1094.102
  • linux-aws Ubuntu 22.04 LTS 5.15.0-1028.32
  • linux-gcp Ubuntu 20.04 LTS 5.4.0-1098.107
  • linux-gcp Ubuntu 22.04 LTS 5.15.0-1027.34

ubuntu advisories UBUNTU-CVE-2022-3643

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • kernel-syms SLES 12 SP2-BCL 4.4.121-92.199.1
  • kernel-source SLES 12 SP2-BCL 4.4.121-92.199.1
  • kernel-default SLES 12 SP2-BCL 4.4.121-92.199.1
  • kernel-syms SLES for SAP 15 SP2, SLES 15 SP2-LTSS, SLE High Performance Computing 15 SP2-LTSS +1 more 5.3.18-150200.24.142.1
  • kernel-source SLES for SAP 15 SP2, SLES 15 SP2-LTSS, SLE High Performance Computing 15 SP2-LTSS +1 more 5.3.18-150200.24.142.1
  • kernel-default SLES for SAP 15 SP2, SLES 15 SP2-LTSS, SLE Live Patching 15 SP2 +3 more 5.3.18-150200.24.142.1
  • kernel-preempt SLES for SAP 15 SP2, SLES 15 SP2-LTSS, SLE High Performance Computing 15 SP2-LTSS +1 more 5.3.18-150200.24.142.1
  • kernel-obs-build SLES for SAP 15 SP2, SLES 15 SP2-LTSS, SLE High Performance Computing 15 SP2-LTSS +1 more 5.3.18-150200.24.142.1

suse advisories SUSE-SU-2023:0420-1SUSE-SU-2023:0406-1SUSE-SU-2023:0152-1SUSE-SU-2023:0134-1SUSE-SU-2022:4617-1SUSE-SU-2022:4615-1

  • linux-lts Arch Linux 6.2-1
  • linux-hardened Arch Linux 6.2-1
  • linux-zen Arch Linux 6.2-1
  • linux Arch Linux 6.2-1

arch linux advisories AVG-2834AVG-2835AVG-2836AVG-2837

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2022-3643 updated cvss 5.5

v1: Guests can trigger NIC interface reset/abort/crash via netback

  • Red Hat Enterprise Linux 6 perf, kernel, python-perf, kernel-kdump, kernel-firmware, kernel-bootwrapper, +1 more Red Hat Enterprise Linux 7 perf, kernel, bpftool, kernel-rt, python-perf, kernel-kdump, +8 more Red Hat Enterprise Linux 8 perf, kernel, bpftool, kernel-rt, kernel-core, kernel-tools, +29 more Red Hat Enterprise Linux 9 rv, perf, rtla, kernel, bpftool, libperf, +83 more
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

cisa ICSA-24-165-10 updated cvss 6.5

Siemens SIMATIC and SIPLUS

  • Siemens SIMATIC CP 1542SP-1 (6GK7542-6UX00-0XE0) <V2.3 Siemens SIMATIC CP 1542SP-1 IRC (6GK7542-6VX00-0XE0) <V2.3 Siemens SIMATIC CP 1543SP-1 (6GK7543-6WX00-0XE0) <V2.3 Siemens SIPLUS ET 200SP CP 1542SP-1 IRC TX RAIL (6AG2542-6VX00-4XE0) <V2.3 Siemens SIPLUS ET 200SP CP 1543SP-1 ISEC (6AG1543-6WX00-7XE0) <V2.3 Siemens SIPLUS ET 200SP CP 1543SP-1 ISEC TX RAIL (6AG2543-6WX00-4XE0) <V2.3
    affected: fixed in V2.3 support.industry.siemens.com

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

Exploit prediction

0.48% chance of exploitation in the next 30 days, higher than 42% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
NVD 3.1 6.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H

Affected products

  • Linux Linux

Classification

Weakness
  • CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component
Technology feeds

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.