CVE-2022-49775

Vulnerability overview

In the Linux kernel, the following vulnerability has been resolved: tcp: cdg: allow tcp_cdg_release() to be called multiple times Apparently, mptcp is able to call tcp_disconnect() on an already disconnected flow. This is generally fine, unless current congestion control is CDG, because it might trigger a double-free [1] Instead of fixing MPTCP, and future bugs, we can make tcp_disconnect() more resilient. [1] BUG: KASAN: double-free in slab_free mm/slub.c:3539 [inline] BUG: KASAN: double-free in kfree+0xe2/0x580 mm/slub.c:4567 CPU: 0 PID: 3645 Comm: kworker/0:7 Not tainted 6.0.0-syzkaller-...

Affected product and versions

Product

Linux Linux, linux kernel

Affected versions

>= 2b0a8c9eee81882fc0001ccf6d9af62cdc682f9e < 0b19171439016a8e4c97eafe543670ac86e2b8fe, >= 2b0a8c9eee81882fc0001ccf6d9af62cdc682f9e < 4026033907cc6186d86b48daa4a252c860db2536, >= 2b0a8c9eee81882fc0001ccf6d9af62cdc682f9e < 9e481d87349d2282f400ee1d010a169c99f766b8, >= 2b0a8c9eee81882fc0001ccf6d9af62cdc682f9e < 78be2ee0112409ae4e9ee9e326151e0559b3d239, >= 2b0a8c9eee81882fc0001ccf6d9af62cdc682f9e < 35309be06b6feded2ab2cafbc2bca8534c2fa41e, >= 2b0a8c9eee81882fc0001ccf6d9af62cdc682f9e < b49026d9c86f35a4c5bfb8d7345c9c4379828c6b, >= 2b0a8c9eee81882fc0001ccf6d9af62cdc682f9e < 1b639be27cbf428a5ca01dcf8b5d654194c956f8, >= 2b0a8c9eee81882fc0001ccf6d9af62cdc682f9e < 72e560cb8c6f80fc2b4afc5d3634a32465e13a51, >= 4.2, >= 4.2 < 4.9.334, >= 4.10 < 4.14.300, >= 4.15 < 4.19.267, >= 4.20 < 5.4.225, >= 5.5 < 5.10.156, >= 5.11 < 5.15.80, >= 5.16 < 6.0.10

Fixed versions

4.9.334, 4.14.300, 4.19.267, 5.4.225, 5.10.156, 5.15.80, 6.0.10

Technical data

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-415