CVE-2022-49372

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

tcp: tcp_rtx_synack() can be called from process context

Laurent reported the enclosed report [1]

This bug triggers with following coditions:

0) Kernel built with CONFIG_DEBUG_PREEMPT=y

1) A new passive FastOpen TCP socket is created.

This FO socket waits for an ACK coming from client to be a complete

ESTABLISHED one.

2) A socket operation on this socket goes through lock_sock()

release_sock() dance.

3) While the socket is owned by the user in step 2),

a retransmit of the SYN is received and stored in socket backlog.

4) At release_sock() time, the socket backlog is processed while

in process context.

5) A SYNACK packet is cooked in response of the SYN retransmit.

6) -> tcp_rtx_synack() is called in process context.

Before blamed commit, tcp_rtx_synack() was always called from BH handler,

from a timer handler.

Fix this by using TCP_INC_STATS() & NET_INC_STATS()

which do not assume caller is in non

Remediation

Check the references section for vendor advisories and patches from linux. Update linux_kernel to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

Affected Products

References