CVE-2022-49450

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2022-49450
In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix listen() setting the bar too high for the prealloc rings AF_RXRPC's listen() handler lets you set the backlog up to 32 (if you bump up the sysctl), but whilst the preallocation circular buffers have 32 slots in them, one of them has to be a dead slot because we're using CIRC_CNT(). This means that listen(rxrpc_sock, 32) will cause an oops when the socket is closed because rxrpc_service_prealloc_one() allocated one too many calls and rxrpc_discard_prealloc() won't then be able to get rid of them because it'll think the ring is empty. rxrpc_release_calls_on_socket() then tries to abort them, but oopses because call->peer isn't yet set. Fix this by setting the maximum backlog to RXRPC_BACKLOG_MAX - 1 to match the ring capacity. BUG: kernel NULL pointer dereference, address: 0000000000000086 ... RIP: 0010:rxrpc_send_abort_packet+0x73/0x240 [rxrpc] Call Trace: <TASK> ? __wake_up_common_lock+0x7a/0x90 ? rxrpc_notify_socket+0x8e/0x140 [rxrpc] ? rxrpc_abort_call+0x4c/0x60 [rxrpc] rxrpc_release_calls_on_socket+0x107/0x1a0 [rxrpc] rxrpc_release+0xc9/0x1c0 [rxrpc] __sock_release+0x37/0xa0 sock_close+0x11/0x20 __fput+0x89/0x240 task_work_run+0x59/0x90 do_exit+0x319/0xaa0

5.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/369de57492c4f1a42563c5a3bd365822ca3bfc79 Patch
https://git.kernel.org/stable/c/4a3a78b7918bdd723d8c7c9786522ca969bffcc4 Patch
https://git.kernel.org/stable/c/5b4826657d36c218e9f08e8d3223b0edce3de88f Patch
https://git.kernel.org/stable/c/616f76498d5ddf26b997caf64a95cda3c8a55533 Patch
https://git.kernel.org/stable/c/61fb38cfbb1d54d3dafd0c25752f684b3cd00b32 Patch
https://git.kernel.org/stable/c/88e22159750b0d55793302eeed8ee603f5c1a95c Patch
https://git.kernel.org/stable/c/91b34bf0409f43bb60453bab23c5beadd726d022 Patch
https://git.kernel.org/stable/c/b3a9b227d5e7467b8518160ff034ea22bb9de573 Patch
https://git.kernel.org/stable/c/e198f1930050e3115c80b67d9249f80f98a27c67 Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
History

17 Mar 2025, 16:12

Type Values Removed Values Added
Summary
  • (es) En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: rxrpc: Se corrige que listen() estableciera la barra demasiado alta para los anillos de preasignación El controlador listen() de AF_RXRPC le permite establecer el backlog hasta 32 (si aumenta el sysctl), pero mientras que los búferes circulares de preasignación tienen 32 ranuras en ellos, una de ellas tiene que ser una ranura muerta porque estamos usando CIRC_CNT(). Esto significa que listen(rxrpc_sock, 32) causará un oops cuando el socket se cierre porque rxrpc_service_prealloc_one() asignó una llamada de más y rxrpc_discard_prealloc() no podrá deshacerse de ellas porque pensará que el anillo está vacío. rxrpc_release_calls_on_socket() luego intenta abortarlas, pero falla porque call-&gt;peer aún no está configurado. Solucione esto configurando el backlog máximo en RXRPC_BACKLOG_MAX - 1 para que coincida con la capacidad del anillo. ERROR: desreferencia de puntero NULL del kernel, dirección: 0000000000000086 ... RIP: 0010:rxrpc_send_abort_packet+0x73/0x240 [rxrpc] Call Trace: ? __wake_up_common_lock+0x7a/0x90 ? rxrpc_notify_socket+0x8e/0x140 [rxrpc] ? rxrpc_abort_call+0x4c/0x60 [rxrpc] rxrpc_release_calls_on_socket+0x107/0x1a0 [rxrpc] rxrpc_release+0xc9/0x1c0 [rxrpc] __sock_release+0x37/0xa0 sock_close+0x11/0x20 __fput+0x89/0x240 task_work_run+0x59/0x90 do_exit+0x319/0xaa0
References () https://git.kernel.org/stable/c/369de57492c4f1a42563c5a3bd365822ca3bfc79 - () https://git.kernel.org/stable/c/369de57492c4f1a42563c5a3bd365822ca3bfc79 - Patch
References () https://git.kernel.org/stable/c/4a3a78b7918bdd723d8c7c9786522ca969bffcc4 - () https://git.kernel.org/stable/c/4a3a78b7918bdd723d8c7c9786522ca969bffcc4 - Patch
References () https://git.kernel.org/stable/c/5b4826657d36c218e9f08e8d3223b0edce3de88f - () https://git.kernel.org/stable/c/5b4826657d36c218e9f08e8d3223b0edce3de88f - Patch
References () https://git.kernel.org/stable/c/616f76498d5ddf26b997caf64a95cda3c8a55533 - () https://git.kernel.org/stable/c/616f76498d5ddf26b997caf64a95cda3c8a55533 - Patch
References () https://git.kernel.org/stable/c/61fb38cfbb1d54d3dafd0c25752f684b3cd00b32 - () https://git.kernel.org/stable/c/61fb38cfbb1d54d3dafd0c25752f684b3cd00b32 - Patch
References () https://git.kernel.org/stable/c/88e22159750b0d55793302eeed8ee603f5c1a95c - () https://git.kernel.org/stable/c/88e22159750b0d55793302eeed8ee603f5c1a95c - Patch
References () https://git.kernel.org/stable/c/91b34bf0409f43bb60453bab23c5beadd726d022 - () https://git.kernel.org/stable/c/91b34bf0409f43bb60453bab23c5beadd726d022 - Patch
References () https://git.kernel.org/stable/c/b3a9b227d5e7467b8518160ff034ea22bb9de573 - () https://git.kernel.org/stable/c/b3a9b227d5e7467b8518160ff034ea22bb9de573 - Patch
References () https://git.kernel.org/stable/c/e198f1930050e3115c80b67d9249f80f98a27c67 - () https://git.kernel.org/stable/c/e198f1930050e3115c80b67d9249f80f98a27c67 - Patch
CWE CWE-476
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.5
First Time Linux linux Kernel
Linux
CPE cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*

26 Feb 2025, 07:01

Type Values Removed Values Added
New CVE
Information

Published : 2025-02-26 07:01

Updated : 2025-03-17 16:12

NVD link : CVE-2022-49450

Mitre link : CVE-2022-49450

CVE.ORG link : CVE-2022-49450

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
CWE-476

NULL Pointer Dereference